Web Media Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network...

HEVC Video Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...

HEVC Video Extensions Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally...

ROS-20260908-73-0087

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox through the created HTML page...

PT-2026-88531

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker to obtain sensitive information through the use of a crafted Chrome extension. Recommendations Update Google Chrome to versi...

PT-2026-88637

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network...

PT-2026-88644

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Extensions allows a remote attacker to bypass system access restrictions to reach a privileged page by using a crafted HTML page. Recommendations Update Googl...

PT-2026-88713

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect reference resolution in Extensions allows a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Recommendations Update Googl...

PT-2026-88758

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Extensions component. A remote attacker can use social engineering to obtain cross-origin data by utilizing a crafted Chrome extension. Recommendations...

Stable Channel Update for ChromeOS / ChromeOS Flex

The Stable channel is being updated to OS version 16765.41.0 Browser version 152.0.7977.113 for most ChromeOS devices. If you find new issues, please let us know one of the following ways: 1. File a bug 2. Visit our ChromeOS communities 1. General: Chromebook Help Community 2. Beta Specific:...

PT-2026-88546

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incomplete cleanup in Extensions allows a remote attacker to bypass system access restrictions through the use of a crafted Chrome extension and social engineering. Recommendations Upda...

PT-2026-88569

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in Extensions allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can...

PT-2026-88579

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Insufficient policy enforcement in Extensions allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This requires the attacker to...

PT-2026-88691

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Extensions allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. Recommendations Update Google Chrome to version...

ROS-20260908-73-0088

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through malicious network traffic...

EUVD-2026-72392

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

SUSE CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

Updated microcode packages fix security vulnerabilities

A potential security vulnerability for some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow escalation of privilege. CVE-2025-31936 A potential security vulnerability in some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions Intel® TDX may allow...

CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...