CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103623

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103631

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

CVE-2026-20841-PoC

It is unclear whether this is the correct PoC trigger method; therefore, it is provided for reference only. CVE-2026-20841 - Windows notepad.exe RCE Exploitation condition: Notepad Version 11.2510 step 1. step 2...

CVE-2026-104848

The Tinypool minimal Node.js worker thread pool implementation is vulnerable to a Prototype Pollution gadget in versions prior to 2.1.1 . The root cause is located in dist/index.js, where the software constructs ThreadPool.options from a normal options object and reads execArgv and env worker opt...

CVE-2026-9645-ScadaBR-Analysis

CVE-2026-9645 — ScadaBR Vulnerability Analysis Technical vulnerability analysis and CVE briefing for CVE-2026-9645 , affecting the open-source ScadaBR SCADA/HMI platform. Overview CVE-2026-9645 is a critical authenticated remote code execution vulnerability in ScadaBR. According to the prepared...

EUVD-2026-91715

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103623

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103631

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103623

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-91714

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103631

A buffer overflow vulnerability in the WebRTC component of Google Chrome (prior to version 154.0.8037.97 ) allows a remote attacker to execute arbitrary code inside the browser's sandbox. The attack is initiated by enticing a user to visit a specially crafted HTML page . While the execution is re...

CVE-2026-103631

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103631

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103623

A use-after-free vulnerability exists in the MediaStream component of Google Chrome prior to version 154.0.8037.97 . This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page . The vulnerability occurs when ...

CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103624

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...