CVE-2026-15157 undici vulnerable to CRLF Injection via blob-like body 'type' property

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-15077 Improper Neutralization of Input Used for LLM Prompting in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed b...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

CVE-2026-11526

A flaw was found in perl-GD. A remote attacker could exploit this vulnerability by providing specially crafted filenames to functions that open files. This issue arises because the makefilehandle function uses Perl's 2-argument open with untrusted input, allowing special characters like pipes or...

CVE-2026-14150

An insufficient validation of untrusted input flaw was found in the Speech component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517376041...

PT-2026-65915

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

chromium -- security fixes

Chrome Releases reports: This update includes 370 security fixes: 514442821 Critical CVE-2026-17650: Use after free in Compositing. 517307966 Critical CVE-2026-17651: Insufficient validation of untrusted input in Dawn. 519262990 Critical CVE-2026-17652: Use after free in Views. 520514458 Critical...

Chromium: CVE-2026-15122 Insufficient validation of untrusted input in Codecs

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-51271

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-67174

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...

CVE-2026-13806

An insufficient validation of untrusted input flaw was found in the Accessibility component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=503333798...

CVE-2026-13812

An insufficient validation of untrusted input flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508293203...

CVE-2026-13777

An insufficient validation of untrusted input flaw was found in the iOSWeb component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513128566...

CVE-2026-13813

An insufficient validation of untrusted input flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508462149...

CVE-2026-13791

An insufficient validation of untrusted input flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=503850012...

CVE-2026-13780

An insufficient validation of untrusted input flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514769383...

CVE-2026-13817

An insufficient validation of untrusted input flaw was found in the Glic component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511739631...

CVE-2026-13816

An insufficient validation of untrusted input flaw was found in the File Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511735715...

CVE-2026-13824

An insufficient validation of untrusted input flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513177497...