PT-2026-84554

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A use after free issue exists in Dawn, which is a WebGPU implementation. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user...

PT-2026-84565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in Navigation allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin polic...

PT-2026-84553

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in SiteSettings allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-84566

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A UI misrepresentation issue in FullScreen mode allows a remote attacker to spoof the address bar by using a specially crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-84558

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description An information leak exists in the MediaCapture component. A remote attacker can potentially leak sensitive information by inducing a user to visit a crafted HTML page. Recommendations...

PT-2026-84551

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A UI misrepresentation issue in FullScreen mode allows a remote attacker to spoof the address bar by using a crafted HTML page. Recommendations Update Google Chrome on Androi...

xmlrpc-c security update

1.51.0-17 - Fix HTML injection in Abyss error responses and directory listings - Resolves: CVE-2026-15928...

PT-2026-89830

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because apply actions and add error use error message text built from request data as a Locale::Maketext bracket notation template...

CVE-2026-84371: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84232: Improper Neutralization of Input During Web Page Generation

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84137: Origin Validation Error

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84125: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84188: Improper Neutralization of Input During Web Page Generation

LibreNMS versions = 26.4.0 contain a stored cross-site scripting vulnerability in the graphdescr. configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any...

RHEL 10 : wget (RHSA-2026:62142)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62142 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap...

RHEL 8 : wget (RHSA-2026:62144)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62144 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory...

ALSA-2026:62144 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory corruption via crafted Metalink URL CVE-2026-58469 wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471...

ALSA-2026:62142 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or denial of service via crafted...

CVE-2026-84124: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

PT-2026-84190

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description A spoofing issue exists within the DOM: Core & HTML component. Recommendations Update Firefox t...

PT-2026-84178

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 155 Mozilla Firefox ESR versions prior to 153.2 Description A use-after-free issue exists within the DOM: Core and HTML components. A use-after-free occurs when an application continues to use a pointer after ...