CVE-2026-106262

An incomplete cleanup flaw was found in the GetUserMedia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/533066295...

CVE-2026-106203

An incomplete cleanup flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553394296...

CVE-2026-106366

An incomplete cleanup flaw was found in the CustomTabs component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552115620...

CVE-2026-106394

Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 all...

CVE-2026-106294

Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 1...

Linux Distros Unpatched Vulnerability : CVE-2026-106203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive...

CVE-2026-106366

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior...

CVE-2026-106394

Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106375

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106243

Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. Chromium security severity: High...

CVE-2026-106366

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Stable Channel Update for Desktop

The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

Astra Linux – Vulnerability in Tomcat9

DoS attack due to a vulnerability related to incomplete cleanup in Apache Tomcat. WebSocket clients were able to keep WebSocket connections open, leading to increased resource consumption. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18,...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104421

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to sk...

CVE-2026-104421

Zebra versions before 6.2.1 are vulnerable to an incomplete cleanup vulnerability (CWE-459). This flaw allows unauthenticated peers to prevent the downloading of valid blocks by leaving rejected hashes in SentHashes . An attacker can transmit a contextually invalid block that shares an honest blo...

EUVD-2026-91432

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to sk...

PT-2026-104232

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to sk...

CVE-2026-104421: Incomplete Cleanup

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to sk...

BIT-TOMCAT-2026-78437 Apache Tomcat: HTTP/2 DoS via malformed request

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...