CVE-2026-103623

A flaw was found in the MediaStream component of chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free condition, where the...

[SECURITY] [DSA 6540-1] radsecproxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6540-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 02, 2026 https://www.debian.org/security/faq -...

CVE-2025-59528-PoC

CVE-2025-59528 PoC 隔離された実験室環境で CVE-2025-59528 を調査するための Proof of Concept です。 !WARNING 免責事項 このプロジェクトは、教育目的、セキュリティ研究、および自分が所有する、または明示的な許可を得てテストするシステムのテスト にのみ使用することを意図しています。 この PoC を、所有者の許可なく第三者サーバー、公開サービス、またはインフラストラクチャに対して使用しないでください。 作者は、このプロジェクトの誤用によって生じたいかなる損害、データ損失、サービス停止、または法的結果についても責任を負いません。 説明...

CVE-2026-103625

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution within the browser's restricted sandbox environment by enticing a user to visit a specially crafted HTML page. This issue is caused by a type confusion vulnerability in the V8 JavaScript engine...

CVE-2026-104843

A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place maliciou...

CVE-2026-103624

A flaw was found in chromium-browser. A remote attacker who has already compromised the renderer process could exploit a use-after-free vulnerability accessing memory after it has been freed in the Contextual Tasks component by convincing a user to visit a crafted HTML page. Successful exploitati...

CVE-2026-30754

A flaw was found in FFmpeg. This memory corruption vulnerability occurs during the Real-time Transport Protocol RTP encoding of H.264/HEVC streams. A remote attacker could exploit this by providing a specially crafted input file, leading to a negative size parameter being passed to a memory copy...

VertXploit

VertXploit HID VertX および EDGE アクセス制御システムを悪用するためのツール 概要 VertXploit は、HID VertX および EDGE アクセス制御システムを悪用するために使用できるツールです。 discoveryd サービスには、システムコールを実行する前にユーザーデータをサニタイズしない脆弱性があります。これにより、認証を必要とせずに HID VertX および EDGE アクセス制御システム上で任意のコードを実行できます。詳細については、コマンドインジェクション のセクションを参照してください。 VertXploit...

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103628

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-91714

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103623

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103626

Google Chrome on Windows versions prior to 154.0.8037.97 is vulnerable to a High severity flaw in the FileSystem component. Due to an incorrect authorization issue, a remote attacker can leverage social engineering to trick a user into interacting with a crafted HTML page . This interaction could...

CVE-2026-92955

A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...

CVE-2026-94084

An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management Http2ThreadMultiBuf. When inspected HTTP/2 response traffic triggers signature rules that evaluate the http.responseheader keyword simultaneously with and without sticky...

AZL-105923 CVE-2026-94422 affecting package xdg-dbus-proxy 0.1.6-2

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

pcre2: pcre2: Out-of-bounds write via crafted regular expression

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...