CVE-2026-9961

Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-9956

Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-9946

CVE-2026-9946 : A use-after-free in ANGLE within Google Chrome (Chromium) allows a remote attacker with a compromised renderer to potentially escape the sandbox via a crafted HTML page. Affected: ANGLE in Chrome prior to 148.0.7778.216. Impact: sandbox escape risk if exploited. Mitigation: upgrad...

CVE-2026-9948

The CVE-2026-9948 entry concerns a use-after-free in the Views component of Google Chrome on macOS, reported as pre-148.0.7778.216. The underlying issue is a use-after-free in the renderer process’s Views handling that could allow a remote attacker who crafts a page to escape the Chrome sandbox. ...

CVE-2026-9941

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-9940

The CVE-2026-9940 entry describes a heap buffer overflow in ANGLE within Google Chrome (Chromium) prior to 148.0.7778.216. The underlying issue is a heap corruption vulnerability triggered by a crafted HTML page, allowing a remote attacker to potentially exploit it. Severity is rated High; attack...

CVE-2026-9938

Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-9931

This CVE-2026-9931 entry describes a use-after-free in Chrome's GPU component prior to version 148.0.7778.216. A remote attacker who already compromised the renderer process could potentially escape the Chrome sandbox via a crafted HTML page. The impact is High (CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:C/...

CVE-2026-9919

Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-9919

CVE-2026-9919: Out of bounds read in WebGL in Google Chrome on Android (before 148.0.7778.216) allows a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: WebGL out-of-bounds read. Impact: cross-origin data leakage. Exploitation status is not provided in the linked doc...

CVE-2026-9896

Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-9877

CVE-2026-9877 is a use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216, enabling a remote attacker who compromises the renderer to potentially escape the sandbox via a crafted HTML page. Affected product: Google Chrome (ANGLE component in Chromium). Root cause: use-after-free in ...

CVE-2026-46427

Budibase prior to 3.38.3 exposes Snowflake private keys via the datasource API. The removeSecrets filter masks only datasource config fields with schema type DatasourceFieldType.PASSWORD; Snowflake integration marks privateKey as SENSITIVE_LONGFORM, which is not filtered, allowing a BASIC-authent...

CVE-2026-2237

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information...

CVE-2024-11399

Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors...

PT-2026-44613

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A use after free issue in ANGLE allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw that occurs wh...

PT-2026-44157

Name of the Vulnerable Software and Affected Versions liquidjs versions prior to 10.26.0 Description LiquidJS is a template engine compatible with Shopify and GitHub Pages. A critical issue allows unauthenticated remote attackers to achieve arbitrary code execution through crafted templates. The...

CVE-2026-8606

A Server-Side Request Forgery (SSRF) in GitHub Enterprise Server was exposed via the security advisories package lookup endpoint, allowing an attacker to issue HTTP requests to internal services. By directing requests to an internal management service and measuring response timing, an attacker co...

CVE-2026-44900 epa4all-client: VAU Signature bypass

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted, the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify. The method performs certificate chain...

CVE-2026-27357 WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Search Analytics: from n/a before 1.5.0...