PT-2026-85242

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Tenda HG21 Hardcoded Root Credentials

Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded administrative account baked into the shipped firmware image. The account is granted full root privileges UID 0 and its credentials are static across devices, meaning any attacker who can reach an exposed management service...

PT-2026-85233

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-85033

Name of the Vulnerable Software and Affected Versions Plesk versions 18.0.79.9 and earlier Plesk versions 18.0.80 through 18.0.80.5 Description A path traversal issue allows local users to execute arbitrary code with root privileges. Path traversal is a flaw that allows an attacker to access file...

PT-2026-85238

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A use after free issue in Skia allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use after free is a memo...

PT-2026-85237

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-85360

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

PT-2026-85341

Summary toml.parse crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 a PEG parser generator as a recursive-descent parser; the value rule mutually recurses with the array and inline-tabl...

VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)

Advisory ID: | VMSA-2026-0007 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 8.1-9.3 Synopsis: | VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities CVE-2026-59346, CVE-2026-59347 Issue date: | 2026-09-03 Updated on: | 2026-09-03 Initial...

PT-2026-85004

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

Oracle Linux 9 : nginx:1.24 (ELSA-2026-59490)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59490 advisory. - Resolves: RHEL-219310 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217962 -...

PT-2026-85236

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-84324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network...

Linux Distros Unpatched Vulnerability : CVE-2026-84334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandb...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-105547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105547 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITESAME No Data Buffer crash In newer version of the SBC specs, we have a NDO...

PT-2026-85031

CVE-2026-59346, a critical VMware Workstation vulnerability, lets an attacker escape a guest VM and execute code on the host. Broadcom rates it 9.3 CVSS. VMware Workstation Fusion CVE202659346 VMXNET3 Broadcom InfoSec PatchNow https://t.co/NTYtL2lmt4 https://t.co/1rHQ9Q4WKZ...

PT-2026-85255

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code,...

PT-2026-85014

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

PT-2026-85020

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images...

PT-2026-85022

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...