CVE-2026-113170

A flaw was found in the Chromium Autofill component. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free condition, where memory is improperly...

CVE-2026-113158

A flaw was found in chromium-browser. A use-after-free vulnerability in the Streaming component allows a remote attacker to achieve arbitrary code execution inside the sandbox. By convincing a user to open a specially crafted HTML page, an attacker can trigger memory corruption to compromise the...

CVE-2026-113111

A flaw was found in chromium-browser. A use-after-free memory vulnerability in the Compositing component allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. By enticing a user to view a malicious webpage, an attacker could exploit this condition ...

CVE-2026-113105

A flaw was found in chromium-browser. A remote attacker can exploit a use-after-free vulnerability—where memory is improperly accessed after being deallocated—in the Extensions component to achieve arbitrary code execution inside the browser sandbox. By convincing a user to visit a specially...

DEBIAN-CVE-2026-113230

Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-113127

Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-113073

Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-112994

Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2016-20102 JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only...

EUVD-2026-104595

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948

The Vitest testing framework (versions 5.0.0-beta.6 through 5.0.5 ) contains a vulnerability where dev servers misapply server.fs.deny. The root cause is that project servers replace Vite's defaults, and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker reachi...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

RLSA-2026:84583 Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafte...

RLSA-2026:84584 Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafte...

PT-2026-118691

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Browser component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

Google Chrome Vulnerability: CVE-2026-112994

Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...