CVE-2026-78895

An information leak in the Paint component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. The Red Hat advisory further notes this could lead to unauthorized access to sensitive information . The CVSS v3.1 base sco...

CVE-2026-78895

Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-78908

Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-78908

An information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass the web origin policy by tricking a user into opening a crafted HTML page. This can lead to exposure of sensitive data across origins. The NVD-assigned CVSS v3.1 score is 4.3 (Me...

CVE-2026-78908

Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-79072

Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79288

CVE-2026-79288 is an improper input validation flaw in the Autofill component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker can obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability was reported by Google...

CVE-2026-79288

Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-79288

Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-78986

CVE-2026-78986 is an uninitialized resource in the GPU subsystem of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially obtain cross-origin data via a crafted HTML page. Chromium rates it High severity, while the CNA-...

EUVD-2026-65773

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-59981

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

CVE-2026-59981 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

Important: Red Hat Security Advisory: Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-62986

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses...

Important: Red Hat Security Advisory: Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

EUVD-2026-65705

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses...

CVE-2026-62986 OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses...

CVE-2026-62986

OpenEXR versions 3.3.0–3.3.12 and 3.4.0–3.4.13 are affected by a stale heap data disclosure in the PyOpenEXR Python bindings. When reading a crafted deep scanline EXR file with layer-prefixed RGB channels (e.g., left.R, left.G, left.B), the lane-offset logic in PyPart::setDeepSliceData() only rec...