CVE-2026-113062

A vulnerability in Google Chrome prior to version 156.0.8078.47 stems from improper input validation in an API. This flaw allows a remote attacker to potentially execute arbitrary code inside the sandbox by serving a crafted HTML page to a victim. The technical details specify a Medium Chromium s...

CVE-2026-113062

Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-92391

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

CVE-2026-112948

A flaw was found in vitest. Vitest development servers fail to properly enforce file access restrictions, permitting access to paths that should be denied. An attacker who can reach an affected development server or who tricks a user into visiting a malicious website can exploit this flaw to read...

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111748 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111748 Source advisory: OSV:GHSA-F9XW-JH8M-3MWQ...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111749 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111749 Source advisory: OSV:GHSA-GX76-C99X-2C96...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111065 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111065 Source advisory: OSV:GHSA-6CJC-53GC-5RQM...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111750 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111750 Source advisory: OSV:GHSA-PQXQ-W44R-73XW...

CVE-2026-92539

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management SCIM API. This allows an authorized...

CVE-2026-97406

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

Information Exposure

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Insertion of Sensitive Information into Log File

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Missing Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Missing Authentication for Critical Function

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to missing authentication and authorization checks in the POST /api/v1/@apostrophecms/import-export/clean-expo...

Missing Authorization

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Missing Authorization due to missing publication permission checks in the import API’s write operations. An authenticated attacker with edit permissions for an...

Missing Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Allocation of Resources Without Limits or Throttling

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...