CVE-2026-87525: Out-of-bounds Read

Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. Chromium security severity: High...

PT-2026-88845

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...

CVE-2026-39020

Wings3D v.2.4.1 is vulnerable to a denial of service when a local attacker supplies a crafted Wavefront OBJ file for processing. The CVSS 3.1 score is 5.5 (MEDIUM) , with local attack vector, low complexity, no privileges required, and user interaction required, impacting only availability. The v...

CVE-2026-39020

An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file...

CVE-2026-21088: Improper Input Validation

Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

PT-2026-88823

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21091: Out-of-bounds Write

Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21099: Improper Handling of Insufficient Permissions or Privileges

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

Backblaze Personal Computer Backup bzserv Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Backblaze Personal Computer Backup bztransmit Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VMSVGA...

Oracle VirtualBox VirtioSCSI Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

CVE-2026-39020: Improper Input Validation

An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file...

PT-2026-88833

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-21086: Improper Input Validation

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

PT-2026-88840

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-87514: Use After Free

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-86423

A flaw was found in ImageMagick, specifically within the PerlMagick component's GetList method. A local attacker could exploit a heap-use-after-free vulnerability by crafting a malicious call to this method. This could lead to a system crash, resulting in a denial of service. Mitigation Mitigatio...

EUVD-2026-74052

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28659

MicroXR Blobstore in Android XR contains a missing permission check that allows access to files belonging to other applications. The vulnerability enables local privilege escalation without requiring additional execution privileges or user interaction. The Android CNA (Google) assigns a CVSS 4.0 ...