Google Chrome code injection vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 146.0.7680.75 contained a code injection vulnerability, which was caused by improper implementation of the V8 engine. This vulnerability could allow remote attackers to execute arbitrary code within a sandb...

Google Chrome buffer error vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 146.0.7680.75 contained a buffer overflow vulnerability. This vulnerability stemmed from out-of-bounds writes in Skia, which could allow remote attackers to execute out-of-bounds memory access via a special...

PT-2026-38097

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description An out of bounds read exists in Fonts, which allows a remote attacker to perform an out of bounds memory read by using a crafted HTML page. An out of bounds read occurs when a program...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the KJ-HTTP process. An attacker can cause the system to interpret a negative Content-Length value as an extremely large unsigned value by sending specially crafted HTTP requests or responses, potentially...

GO-2026-4684 Traefik: HTTP/2 frames can cause a running server to panic in github.com/traefik/traefik

Traefik: HTTP/2 frames can cause a running server to panic in github.com/traefik/traefik...

GO-2026-4672 Quill has DoS via unbounded read of HTTP response body during notarization in github.com/anchore/quill

Quill has DoS via unbounded read of HTTP response body during notarization in github.com/anchore/quill...

CVE-2026-32240 Cap'n Proto: Integer overflow in KJ-HTTP chunk size

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component...

firefox: thunderbird: Undefined behavior in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the DOM: Core & HTML component...

bad reuse of HTTP Negotiate connection

...

EUVD-2026-11432

Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-25819

HMS Networks Ewon Flexy and Cosy+ are vulnerable to a Denial of Service (DoS) attack due to improper handling of specially crafted HTTP requests. The vulnerability allows unauthenticated attackers to trigger a device reboot , provided they have access to the device's GUI. Affected versions includ...

HTTP/2 Python-h2 CRLF Sequences

The vulnerability of the HTTP/2 protocol and Python-h2 is related to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker operating remotely to compromise data integrity...

CKEditor < 47.6.0 XSS

The version of CKEditor included on the remote web host prior to 47.6.0. It may, therefore, be affected by a cross-site scripting XSS vulnerability. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Prior to version 47.6.0, a cross-site scripting XSS vulnerability has...

CVE-2026-3940

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-3942

Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3942

Google Chrome versions prior to 146.0.7680.71 are vulnerable to a security bypass caused by an incorrect security UI within the PictureInPicture technology. A remote attacker can exploit this through a crafted HTML page to perform UI spoofing or deceive the user, potentially compromising the inte...

CVE-2026-3938

CVE-2026-3938 affects Google Chrome/Chromium clipboard policy enforcement. Prior to version 146.0.7680.71, a renderer-compromised attacker could leak cross-origin data via a crafted HTML page due to insufficient clipboard policy enforcement. Impact is data leakage with low severity according to C...