PT-2026-38106

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 148.0.7778.96 Description Insufficient policy enforcement in DevTools allows a local attacker to perform privilege escalation by using a malicious file. Recommendations Update to version 148.0.7778.96...

Google Chrome DevTools Structure Disclosure

The vulnerability of the DevTools suite for web development in the Google Chrome web browser is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

Fedora 42 : chromium (2026-2a5d3e5194)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2a5d3e5194 advisory. Update to 147.0.7727.116 High CVE-2026-6919: Use after free in DevTools High CVE-2026-6920: Out of bounds read in GPU Medium CVE-2026-6921: Race in...

Timing Attack

org.springframework.boot, spring-boot-devtools is vulnerable to a timing attack. The vulnerability is due to insecure comparison of the DevTools remote secret, which allows an attacker on the same network to exploit timing differences to guess the secret and potentially achieve remote code...

CVE-2026-6919

An use after free flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=493652473...

GHSA-F5FM-9JMP-C88R Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fh32-73r9-rgh5. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing...

Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fh32-73r9-rgh5. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.7, <=2.0.3), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.7, <=2.0.3) +174 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.10, <=2.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.10, <=2.0.4) +223 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.oneops:secrets-proxy (>=1.3.0, <=1.5.0), com.swisscom.cloud.sb:broker (>=2.13.0, <=4.0.2) +288 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.13.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.oneops:secrets-proxy =1.3.0, =2.13.0, =4.0.2 -...

de.adorsys.aspsp:aspsp-profile (>=1.7, <=1.7.1), de.adorsys.aspsp:consent-management-system (>=1.7, <=1.8) +39 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.16.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - de.adorsys.aspsp:aspsp-profile =1.7, =1.7, =1.7, =1.7, =1.7,...

com.swisscom.cloud.sb:broker (>=2.11.2, <=2.12.1), edu.wisc.my.apps:lti-proxy (>=1.0.1, <=2.0.1) +116 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.swisscom.cloud.sb:broker =2.11.2, =1.0.1, =1.0.3, =0.0.1,...

io.fabric8:fabric8-maven-generator-spring-boot (>=3.1.66, <=3.1.70), io.fabric8:fabric8-maven-plugin (>=3.1.65, <=3.1.70) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - io.fabric8:fabric8-maven-generator-spring-boot =3.1.66,...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: OSV:GHSA-56V8-86GJ-66JP...

org.springframework.boot:spring-boot-docs (1.4.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.5.release Sourc...

org.springframework.boot:spring-boot-docs (1.4.6.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.6.release Sourc...

com.github.wanggit:access-frequency-spring-boot-starter (>=1.0.0, <=1.0.1-snapshots), com.github.xiaoping1988.spring.boot:mybatis-ping-spring-boot (1.0.1) +229 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.github.wanggit:access-frequency-spring-boot-starter =1.0....

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.5) +28 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server =1.3.0, =1.8.1 -...