CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

CVE-2025-59181

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users...

CVE-2025-59178

CVE-2025-59178 affects Ericsson Packet Core Controller (PCC) prior to 1.39. The vulnerability arises in Configuration Management, exposing sensitive system information that allows an attacker to enumerate other users on the system. According to the CVSS metrics, the impact is primarily on confide...

CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

MGASA-2026-0298 Updated graphite2 packages fix a security vulnerability

The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. CVE-2026-50593...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

EUVD-2026-48447

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users...

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-65903

DOMPurify before 3.4.0 contains a logic error in the ADDTAGS function where short-circuit evaluation allows forbidden tags to bypass FORBIDTAGS restrictions. Attackers can craft input containing tags listed in FORBIDTAGS that are also added via ADDTAGS function, causing them to be retained in...

EUVD-2026-48162

Subscriber Broken Access Control in WP Booking System 5.12.8.1 versions...

Astra Linux – Vulnerability in Chromium

The use of “after free” in File Input in Google Chrome prior to version 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Leakage of side-channel information in ComputePressure in Google Chrome prior to version 150.0.7871.47 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of after-free in ANGLE in Google Chrome before version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in Ozone in Google Chrome before version 150.0.7871.47 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...