CVE-2026-105746

A flaw was found in Docling. The document processing pipeline fails to honor configurations that disable remote network services when utilizing the KServe V2 optical character recognition OCR model. This failure can result in unintended information disclosure, as page images from processed...

CVE-2026-105743

A flaw was found in docling. A remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability by providing crafted URLs when remote resource fetching is enabled. Incomplete validation allows requests to be resolved again by the network client, enabling techniques such as Domain Name...

ROS-20261006-73-0080

The vulnerability of the mvpp2bmswitchbuffers function in the drivers/net/ethernet/marvell/mvpp2/mvpp2main.c file of the Ethernet network adapter driver for the Marvell-based Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a...

Rocky Linux 10.1 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_1334)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261334 advisory. glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network query...

CVE-2026-106418: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

CVE-2026-106385: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. Chromium security severity: Low...

ROS-20261006-73-0001

The vulnerability of the mcp251xopen function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver is related to the creation of critical data packets. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-106916

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue exists in the Proxy Auth component where incomplete cleanup allows an adjacent attacker to obtain sensitive information by sending crafted network traffic. Recommendations Upda...

CVE-2026-106234: Use After Free

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-106267: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106889

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the Proxy component of Google Chrome on Windows. This issue allows an adjacent attacker to obtain sensitive information by sending crafted network traffic...

PT-2026-106907

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Network component. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by using social engineering and a...

CVE-2026-106307: Incorrect Authorization

Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-98330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial...

EUVD-2025-211036

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request from the local Wi-Fi network that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...

ROS-20261006-73-0086

The vulnerability of the manahwcDestroyChannel function in the drivers/net/ethernet/microsoft/mana/hwchannel.c file of the Ethernet network adapter driver in Microsoft’s Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker ...

CVE-2026-82989: Improper Neutralization of Special Elements in Output Used by a Downstream Component

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2025-71383: Improper Input Validation

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request from the local Wi-Fi network that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...

CVE-2026-105762: Server-Side Request Forgery (SSRF)

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-102156: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of Lightweight Directory Access Protocol LDAP authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service...