SUSE CVE-2026-87472

Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87599

Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87600

Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

polkit: Polkit: Denial of Service via unbounded input processing through standard input

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input stdin. This unbounded input can lead to an out-of-memory OOM condition, resulting in a Denial of Service DoS for the...

CLEANSTART-2026-HL20029 JLine is a Java library for handling console input

Multiple security vulnerabilities affect the kafka package. JLine is a Java library for handling console input. See references for individual vulnerability details...

CLEANSTART-2026-VO23255 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the metallb package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-SS34822 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the metallb package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-XP64749 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

PT-2026-89366

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

PT-2026-89330

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

PT-2026-89338

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save function which only sanitizes array values, not scalar...

PT-2026-89409

Name of the Vulnerable Software and Affected Versions LIBRID/LIBREF versions 2.01.0.2183 through 18.9.26.2319 Description Improper neutralization of input during web page generation allows Stored Cross-Site Scripting XSS, a condition where malicious scripts are permanently stored on the target...

VulnCheck KEV: CVE-2026-51990

Sogou Input Method contains a chain of three weaknesses that, if successfully exploited, could allow remote code execution. An attacker could exploit this vulnerability by convincing a user to click a specially crafted link...

PT-2026-89258

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

ROS-20260910-73-0061

The vulnerability of the NetworkCache component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260910-73-0056

The vulnerability of the OptimizationGuide component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, as well as cause service failures through a specially created HTML pa...

ROS-20260910-73-0099

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260910-73-0108

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

ROS-20260910-73-0141

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

ROS-20260910-73-0044

The vulnerability of the Chromoting component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...