PT-2026-106930

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the HTML component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after...

aprsd (>=2.3.0, <=2.5.9), cacaodocs (>=0.1.3, <=0.1.14) +19 more potentially affected by CVE-2026-102598 via werkzeug (2.0.0)

werkzeug PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aprsd =2.3.0, =0.1.3, =1.9.4rc2, =0.1.1, =1.5.3, =0.12.0, =1.0.0, =2.9.1, =0.28.1, =1.0.0, =0.3.0.0, =4.2.11.10, =4.2.11.11 - quickboard 0.1.1 a...

org.apache.hop:hop-transform-snowflake-bulkloader (>=2.2.0, <=2.4.0), org.finos.legend.engine:legend-engine-xt-persistence-component-relational-snowflake (>=release-4.96.3, <=4.141.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.19)

net.snowflake:snowflake-jdbc MAVEN version 3.13.19 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.apache.hop:hop-transform-snowflake-bulkloader =2.2.0, =release-4.96.3, =4.141.0 -...

EUVD-2026-91749

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling...

EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-100818

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2026-103622

An use after free flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742179...

CVE-2026-100791

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-100778

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100805

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Audio/Video component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi...

CVE-2026-100804

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Preferences: Backend component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100768

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: WebGPU component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Serialization. The supported versions affected by this vulnerability are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...