Coldai Aono FastAPI code generator improper output handling vulnerability

A security vulnerability exists in Koudai Aono FastAPI code generator versions prior to 0.8.1. This vulnerability arises because the generator fails to escape quotes within OpenAPI paths, inserting them into the @app.get route decorator string. As a result, attackers can inject Python expressions...

PT-2026-136570

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A type confusion issue exists in PDFium, a PDF rendering engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the application to process a...

PT-2026-136448

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description Incorrect authorization in DevTools allows a remote attacker to potentially execute arbitrary code outside the sandbox. This occurs when a user is tricked via social engineering into...

PT-2026-136560

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A buffer overflow exists in Dawn, a WebGPU implementation, which allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a craft...

PT-2026-136516

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A use after free issue in the DOM allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use after free is a...

PT-2026-136486

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A use after free issue exists in WTF, which can allow a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use afte...

PT-2026-136559

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A use after free issue exists in ANGLE, which is a compatibility layer that allows OpenGL ES APIs to run on non-native platforms. This flaw allows a remote attacker to execute arbitrary...

CVE-2026-121229: Google Chrome: Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to…

Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-121230: Google Chrome: Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…

Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

DEBIAN-CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

Exploit for CVE-2026-86596

CVE-2026-86596 PoC Single-file Python PoC for the s2Member...

CVE-2026-120752

A flaw was found in PyMuPDF. An attacker who controls input passed to the free text annotation feature can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS by crashing the application. This issue is caused by copying caller-supplied callout points into a...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

CVE-2026-86596

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, = 260927 via the 'itemname' parameter parameter. This is due to insufficient sanitization in stripphptagsdeep, which only strips literal '?' sequences, combined with a post-interpolation...

CVE-2026-120752 PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120752

The PyMuPDF library (versions 1.25.3 before 2.0) is susceptible to a stack-based buffer overflow in the JM_set_annot_callout_line() function. The root cause is the copying of a caller-supplied number of callout points into a fixed three-element stack array. An attacker who controls the callout ar...

CVE-2026-116014

A flaw was found in open62541. This vulnerability allows a malicious Open Platform Communications Unified Architecture OPC UA server to trigger arbitrary code execution or a Denial of Service DoS on connecting client applications. By supplying specially crafted, oversized custom data type...