EUVD-2026-113441

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-119272

An out-of-bounds read flaw exists in the FileSystem component of the Google Chrome browser (prior to version 156.0.8078.79 ). This vulnerability allows a remote attacker to read memory inside the sandbox by leveraging a crafted HTML page . No specific exploit details or patch versions are provide...

CVE-2026-119272

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-119272

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

cve-2022-22965

Spring4Shell - CVE-2022-22965 Build let's clone the repository, build and run the container $ git clone https://github.com/twseptian/cve-2022-22965.git $ cd cve-2022-22965 $ docker build . -t spring4shell-poc $ docker run -p 8080:8080 --name spring4shell-poc spring4shell-poc check the access usin...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs-packaging, module.nodejs-packaging, nodejs-nodemon, nodejs, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

CVE-2026-78402: Thalesgroup Sentinel Keys Server: Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows…

Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It...

CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

PT-2026-133613

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

CVE-2026-119086: FreeRTOS FreeRTOS-Kernel: Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on…

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privilege...

PT-2026-133618

Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap...

CVE-2026-61826: morpheus65535 bazarr: Bazarr is a companion application to Sonarr and Radarr

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...

CVE-2026-104063: Scribus: Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when…

Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap...

CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/deptI...

PT-2026-133665

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow... gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations...

PT-2026-133534

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before dispatch hook installed by startup removes PATH INFO from the end of the request URI with a substitution that interpolates PATH INF...

CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...