CVE-2026-7991

Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-7981

Out of bounds read in Codecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a malicious file. Chromium security severity: Medium...

CVE-2026-7923

Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Velocidex Velociraptor has an Incorrect Authorization issue

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization the lowest authenticated role, holding only READRESULTS permission can issue a single authenticated HTTP GET that can read any files...

CVE-2026-8014

Google Chrome and Microsoft Edge browsers are affected by a vulnerability in the Preload mechanism due to an inappropriate implementation. A remote attacker can exploit this flaw using a crafted HTML page to leak cross-origin data , potentially resulting in unauthorized access to protected inform...

CVE-2026-8012

Google Chrome versions prior to 148.0.7778.96 are vulnerable to a Cross-Site Scripting (UXSS) flaw due to an inappropriate implementation in the MHTML component. A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page to inject arbitrary sc...

CVE-2026-8008

Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-7996

Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-7991

Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-7987

Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-7975

Use after free in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-7957

Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-7949

Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-7921

A use after free vulnerability in the Passwords component of Google Chrome (and Chromium ) prior to version 148.0.7778.96 allows a remote attacker to execute arbitrary code via a crafted HTML page. The issue stems from the reuse of passwords after they were released. Practical impacts include pot...

CVE-2026-7898

Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. Chromium security severity: Critical...

CVE-2026-42437

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-43870

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting', Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift:...

Slackware Linux 15.0 / current hunspell Vulnerability (SSA:2026-125-01)

The version of hunspell installed on the remote host is prior to 1.7.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-125-01 advisory. New hunspell packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

CoreDNS security vulnerabilities

CoreDNS is a DNS server within the CoreDNS community. Versions of CoreDNS prior to 1.14.3 contained a security vulnerability. This vulnerability stemmed from the tsig plugin’s trust transfer writer, which relied on TsigStatus for verification instead of performing its own validation. This allowed...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a resource management vulnerability. This vulnerability stemmed from the reuse of resources after TopChrome was released, which could allow remote attackers to execute a sandbox esca...