CVE-2026-19160

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the disclosure of sensitive cross-origin data...

CVE-2026-19168

A flaw was found in V8 in Google Chrome. An inappropriate implementation allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to unauthorized code execution...

CVE-2026-19162

A flaw was found in V8, the JavaScript engine used in Google Chrome. This out-of-bounds write vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox environment. Exploitation occurs when a user visits a specially crafted HTML page. This could lead to...

CVE-2026-19150

A flaw was found in V8, the JavaScript engine used in Google Chrome. An inappropriate implementation vulnerability allowed a remote attacker to execute arbitrary code within the browser's sandbox. This could be achieved by enticing a user to visit a specially crafted HTML page. The primary impact...

CVE-2026-19177

A flaw was found in Chromium. A remote attacker, after compromising the renderer process, could exploit insufficient validation of untrusted input in the user interface UI by crafting a malicious HTML page. This could potentially allow the attacker to escape the browser's security sandbox, leadin...

CVE-2026-19144

A flaw was found in Google Chrome. This vulnerability, known as a use-after-free, occurs when the program attempts to use memory that has already been deallocated. A remote attacker could exploit this by tricking a user into visiting a specially crafted HTML page. Successful exploitation could le...

CVE-2026-19141

A flaw was found in Chromium. This use-after-free vulnerability in the Resources component on Android could allow a remote attacker, who has already compromised the renderer process, to potentially escape the sandbox. This could be achieved by enticing a user to visit a specially crafted HTML pag...

CVE-2026-19140

A flaw was found in Google Chrome's GPU component. This use-after-free vulnerability allows a remote attacker, who has already compromised the browser's renderer process, to potentially escape the browser's security sandbox. This escape can be achieved by tricking a user into visiting a specially...

CVE-2026-19137

A flaw was found in Google Chrome on Android. This vulnerability, a use-after-free error in the WebGL component, could be exploited by a remote attacker. After compromising the renderer process, the attacker could craft a malicious HTML page to trigger the flaw. This could potentially lead to a...

CVE-2026-10050

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

Azure Monitor Agent Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-58115

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4.1 running Industrial OS with Node-RED installed. Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are...

CVE-2026-69109

Siemens License Server (SLS) is affected across all versions

EUVD-2026-56126

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without...

CVE-2026-72544

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-57516

A flaw was found in Ray. This unsafe deserialization vulnerability in the WebDataset reader allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted malicious tar archive to the readwebdataset function, an attacker can trigger the unconditional deserializatio...