CVE-2026-91730: Incomplete Cleanup

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91724: Use After Free

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-91930

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

CVE-2026-91708: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-83206: Improper Access Control

Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications component: Base. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTT...

CVE-2026-91739: Missing Authorization

Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91733: Improper Check for Unusual or Exceptional Conditions

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-91959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a...

PT-2026-93169

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

PT-2026-91997

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Thunderbird versions prior to 156 Description Incorrect boundary conditions exist within the Security: Process Sandboxing component. Process sandboxing is a security mechanism that isolates running processes from...

PT-2026-92933

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Workbenches. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardwa...

PT-2026-93130

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in Extensions on Mac allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox. This is achieved throu...

PT-2026-93151

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Improper state validation in Skia allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. Skia is a 2D graphic...

PT-2026-93157

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Transactions Platform allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-93161

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in Core allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. A race...

PT-2026-93165

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use after free issue in Skia allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page. Use after free is a memory...

CVE-2026-91925: Improper Neutralization of Special Elements Used in a Template Engine

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

CVE-2026-91743: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91727: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-83200: Improper Access Control

Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromi...