CVE-2026-113309

Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113193

Google Chrome versions prior to 156.0.8078.47 are vulnerable to a memory corruption issue within the V8 engine. A remote attacker can exploit this vulnerability by using a crafted HTML page to potentially read memory inside the sandbox . The vulnerability has been addressed in the 156.0.8078.47 s...

CVE-2026-113193

Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113193

Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port

A flaw was found in the Linux kernel's bridge multicast functionality. Improper management of multicast contexts when a bridge port is removed can lead to a use-after-free vulnerability. This issue could allow a local attacker to cause a system crash, resulting in a denial of service...

Allocation of Resources Without Limits or Throttling

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling which allows an unauthenticated remote attacker to create server-side upload state, write chunk data to...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

CVE-2026-113724

A flaw was found in virtualenv. When cleaning up files, the deletion error-handling routine follows symbolic links when attempting to restore write permissions for removal. A local attacker can exploit this issue by planting a symbolic link pointing to a file owned by the executing user, causing...

CVE-2026-113721

A flaw was found in virtualenv. A local attacker can exploit this issue by pre-creating symbolic or hard links in a destination directory before an environment is set up. Because virtualenv does not properly check or replace existing links when writing configuration and activation files, it can...

DEBIAN-CVE-2026-113867

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

CVE-2026-113867

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

DEBIAN-CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

AZL-110094 CVE-2026-113716 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113720

A flaw was found in virtualenv. When creating new environments, cached package files retain their original permissions rather than respecting the current user file-creation mask umask. On shared systems where an environment directory is accessible to other users, a local attacker can modify these...

CVE-2026-113719

A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...

CVE-2026-113713

A flaw was found in virtualenv. When configured to link application data through environment variables or configuration files, virtualenv can leave newly created environments linked to temporary package files that are deleted after setup completes. Because the virtual environment references an...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the tools/call request handler in mcp.ts, where an attacker can send a...