PT-2026-83997

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE NAME value used by set file name and load meta data in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE NAME value with the settings...

PT-2026-83883

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and...

The vulnerability of the Ozone component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Ozone component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the TabStrip component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the TabStrip component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Proxy component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Proxy component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to trigger a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of the Views component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the CSS components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to access confidential data through a specially created HTML page...

The vulnerability of the Tab Strip component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the TabStrip component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the InterestGroups component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the InterestGroups component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Video component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Video component in Google Chrome and Microsoft Edge browsers is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially crafted HTML page...

CVE-2026-80702

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...

PT-2026-83971

A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...

CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...

The vulnerability of the Web Authentication component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Web Authentication component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to trigger a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

CVE-2025-71407

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DT...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the UI components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the UI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...