CVE-2026-17733

An inappropriate implementation in the QUIC protocol within Google Chrome on Android (prior to version 151.0.7922.72) allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability affects the chromium package. No specific exploit details or remediation steps are p...

CVE-2026-17673

A high-severity integer overflow vulnerability exists in the QUIC protocol within Google Chrome versions prior to 151.0.7922.72 . A remote attacker who has already compromised the renderer process could potentially achieve a sandbox escape by interacting with a crafted HTML page. This vulnerabili...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow a malicious actor to gain full control ov...

DHCP Client Service Privilege Escalation

The vulnerability of the DHCP Client Service for Windows operating systems is related to a countable level of significance loss. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

Oracle WebCenter Content Full Control

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform relates to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP network...

SMC Protocol Heap Buffer Overflow DoS

The vulnerability of the smctcpsynrecvsock function in the net/smc/afsmc.c module of the SMC protocol family implementation in Linux’s kernel relates to the reutilization of previously freed memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrit...

Linux Bluetooth DoS

The vulnerability of the functions sessionfree, hidpsessionRemove, and hidpSessionThread in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a...

Core server component Full Control

The vulnerability of the Core server component of Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain full control over the application through the HTTP network protocol...

Oracle WebCenter Content Full Control

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP network protocol...

JetBrains TeamCity < 2025.11.7 / 2026.x < 2026.1.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.7, or prior to 2026.1.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

PT-2026-66367

Name of the Vulnerable Software and Affected Versions WP Ghost Hide My WP Ghost versions prior to 7.0.05 Description The plugin fails to verify if client IP information originates from a trusted proxy before trusting attacker-controllable HTTP headers. This allows unauthenticated attackers to spo...

PT-2026-66623

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists in the ACSE layer during the processing of AARQ PDUs Application Association Request Protocol Data Units during MMS connection establishment. An...

PT-2026-65992

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An integer overflow exists in the QUIC protocol implementation. A remote attacker who has already compromised the renderer process can potentially achieve a sandbox escape by inducing t...

Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a...

PT-2026-66634

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages...

PT-2026-66435

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack...

MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...

PT-2026-66519

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description Unauthenticated remote code execution is possible via environment variable injection in the MCP Model Context Protocol stdio launcher. The issue occurs in the...

PT-2026-66363

Name of the Vulnerable Software and Affected Versions PCP affected versions not specified Description A flaw in the linux sockets module exposes an unsecured internal connection. An attacker who has already achieved initial code execution can exploit this weakness to escalate privileges and execu...

PT-2026-66430

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...