CVE-2026-113202

A flaw was found in the BrowserTag component of chromium-browser. A remote attacker could exploit this vulnerability to execute arbitrary code within the browser sandbox by convincing a user to open a specially crafted HTML page. This issue is caused by a use-after-free condition, where the...

CVE-2026-113160

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser sandbox by enticing a victim to visit a specially crafted HTML page. This vulnerability stems from a use-after-free condition in the Turbolev component, which occurs when the application attempts...

CVE-2026-113107

A flaw was found in chromium-browser. A memory management issue known as a use-after-free flaw exists in the Media component. By convincing a user to open a specially crafted HTML page, a remote attacker could exploit this vulnerability to execute arbitrary code within the browser's restricted...

CVE-2026-113168

A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the browser's sandbox environment by convincing a user to visit a specially crafted HTML page. This vulnerability is caused by a use-after-free memory issue in the Permissions component...

CVE-2026-113155

A flaw was found in the Glic component of chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code within the application sandbox by convincing a user to visit a specially crafted HTML page. The issue is caused by a use-after-free memory corruption condition during...

CVE-2026-113141

A flaw was found in chromium-browser. A use-after-free vulnerability in the Transactions Platform allows a remote attacker to execute arbitrary code inside the sandbox by enticing a user to visit a crafted HTML page. This issue occurs when the application accesses memory after it has been release...

CVE-2026-113119

A flaw was found in chromium-browser. A use-after-free memory corruption issue in the Network component allows a remote attacker to execute arbitrary code within the browser sandbox. To exploit this vulnerability, an attacker must trick a user into visiting a specially crafted HTML page...

CVE-2026-113065

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to load a specially crafted HTML page. The issue is caused by a use-after-free condition within the Media component...

CVE-2026-113042

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution within the browser's sandbox environment. This issue is caused by a use-after-free memory management...

CVE-2026-113014

A flaw was found in chromium-browser. A use-after-free vulnerability exists in the PerformanceAPIs component, which occurs when memory is accessed after it has already been released. A remote attacker could exploit this flaw by enticing a user to view a specially crafted HTML page, potentially...

CVE-2026-113015

A flaw was found in chromium-browser. Due to improper memory handling a use-after-free condition within the Workers component, a remote attacker can execute arbitrary code inside the browser's sandbox environment. To exploit this vulnerability, the attacker must convince a user to load a speciall...

CVE-2026-113009

A flaw was found in Chromium's WindowControlsOverlay component. A remote attacker could trick a user into visiting a crafted HTML page to trigger a use-after-free memory condition. Successful exploitation allows the attacker to execute arbitrary code within the browser sandbox...

PT-2026-120238

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

PT-2026-120185

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST...

Linux Distros Unpatched Vulnerability : CVE-2026-113049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-113044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

PHP CGI SAPI 8.4.26 Pointer Underflow Remote Code Execution

PHP CGI SAPI versions 5.x through 8.4.26 reportedly contain a pointer underflow vulnerability in sapi/cgi/cgimain.c when cgi.fixpathinfo=1 is enabled. Manipulating PATHINFO with URL-encoded newline characters can trigger out-of-bounds pointer arithmetic, resulting in heap corruption and potential...

PT-2026-120552

Imperia CMS = 11.5.4 SiteActive TEMPLATE CVE-2026-110355: Unauthenticated SSTI in Imperia CMS 11.5.4 and earlier enables remote code execution via SiteActive's TEMPLATE parameter when PHP is available. https://t.co/PV7cbsAEcp...

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...