PT-2026-90196

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP allows a attacker to compromise the integrity of the protected information.

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected...

ROS-20260911-73-0242

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-88027

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

EUVD-2026-75641

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

EUVD-2026-75451

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88921

MISP (versions ≤2.5.45) contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, used during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type...

ROS-20260910-73-0134

The vulnerability of the Blink component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260910-73-0136

The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

ROS-20260910-73-0135

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260910-73-0096

The vulnerability of the WebXR component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260910-73-0105

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and also cause service interruptions throug...

ROS-20260910-73-0103

The vulnerability of the PageInfo component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260910-73-0067

The vulnerability of the Speech component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260910-73-0131

The vulnerability of the SplitView component in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260910-73-0080

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260910-73-0082

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260910-73-0085

The vulnerability of the Parser component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability allows an attacker to compromise data integrity through a specially created HTML page...