CVE-2026-76030: Google Chrome: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119271: Google Chrome: Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code…

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-134217

In Trail of Bits fickling through 0.1.12, the process import method in fickle.py adds an imported name to the likely safe imports set whenever the source module is present in sys.stdlib module names and the name is absent from the UNSAFE IMPORTS denylist, without inspecting what the name resolves...

CVE-2026-107050

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution...

PT-2026-133650

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/ compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string...

CVE-2026-119716: wbond, up9inc: pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that…

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...

CVE-2026-37468: n/a: Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...

CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the clien...

CVE-2026-119269: Google Chrome: Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code…

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110133

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated...

Linux Distros Unpatched Vulnerability : CVE-2026-119193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory logic in src/Runner/Phpt/TestCase.php creates temporary...

CVE-2026-84243: The GNU C Library glibc: The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries…

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

PT-2026-133603

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTML QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms...

PT-2026-134155

pgAdmin 4 runs pg dump, pg restore, pg dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGE DIR, not under a SHARED STORAGE directory, which ordinary users can upload files...

PT-2026-134231

Name of the Vulnerable Software and Affected Versions sevenz-rust2 versions prior to 0.21.1 Description Extracting a malicious 7z archive allows writing or overwriting files outside the intended destination directory. In src/util/decompress.rs, the decompress impl function calculates the...

PT-2026-134240

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, the header parameter name in parameters.name with in: header is emitted verbatim into a Refit Header"" attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can...

PT-2026-134243

Name of the Vulnerable Software and Affected Versions OpenSearch versions 2.8.0.0 through 2.19.6.0 OpenSearch versions prior to 3.7.0.0 Description A remote authenticated user with basic read/search permissions can trigger unsafe deserialization of untrusted data by providing a crafted cursor...

PT-2026-134413

Summary AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has ...

CVE-2026-63345: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as Get" " without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed...