CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-110144

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-110140

Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

UBUNTU-CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

PT-2026-115314

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description Memory corruption occurs in the DOM Document Object Model, which is the programming interface for HTML and XML documents. This issue allows a remote attacker to execute arbitrary code...

PT-2026-115003

🚨 CVE-2026-92982 A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : YAML-LibYAML vulnerabilities (USN-8925-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8925-1 advisory. Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection...

Unity Linux 20.1070e Security Update: golang (UTSA-2026-130379)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130379 advisory. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-97229)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

PT-2026-115322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description A use after free issue exists in V8, which is the open-source JavaScript and WebAssembly engine used in Google Chrome. A remote attacker can execute arbitrary code within the sandbox by...

UBUNTU-CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

PT-2026-115218

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 26.2.3 Description Internal messaging components of the product fail to adequately validate the origin of received messages. This improper origin validation allows an unauthenticated remote attacker...

PT-2026-114910

Path Traversal CWE-22 in the execute obj function of the archive object viewer peach.pas in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... - Associated application" action Shift+Ctrl+O to execute an...

PT-2026-114758

Name of the Vulnerable Software and Affected Versions 10Web Booster versions prior to 2.34.11 Description An arbitrary file upload issue exists in the compressCustom function. The flaw stems from missing file type validation and extension filtering on the page id parameter. This is combined with ...

CVE-2026-110155

Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-90954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and...

PT-2026-115176

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate sub path strips leading slashes while pathlib's join discards the base...

Cisco Secure Email Gateway Advanced Malware Protection Privilege Escalation

The vulnerability of the Advanced Malware Protection module of the Cisco Secure Email Gateway protection tool is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files and execute...

CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

UBUNTU-CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...