ROS-20260911-73-0224

The vulnerability of the Glic component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0223

The vulnerability of the Subresource Integrity component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

ROS-20260911-73-0137

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0031

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

ROS-20260911-73-0063

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0056

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0097

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0061

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0064

The vulnerability in Chromium is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260911-73-0091

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

Oracle Linux 10 : ELSA-2026-65899-0: / postgresql16-postgis (ELSA-2026-658990)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658990 advisory. 3.5.3-4.1 - Fix CVE-2026-73515: validate flatgeobuf input buffers before decoding Tenable has extracted the preceding description block directly from the...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...

Improper Validation of Specified Type of Input

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the meta object in calendar events, which is stored without validation. An attacker can disrupt calendar alert functionality for all users by submitting a...

CVE-2026-78571

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-88062

OmniRoute (versions 3.8.49 and earlier ) is vulnerable to Remote Code Execution (RCE) via the POST /api/acp/agents endpoint. The application fails to properly validate user-controlled binary and versionCommand values, relying only on a self-consistency check that allows attackers to supply interp...