PT-2026-106368

Unauthenticated Sensitive Data Exposure in Xserver Migrator = 1.6.6 versions...

CVE-2026-106501: Exposure of Sensitive Information to an Unauthorized Actor

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

PT-2026-106353

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs when geographic mapping data is accessed and modified concurrently without proper synchronization. This issue stems from a race...

PT-2026-106798

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintended files...

PT-2026-106859

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in the Media component allows a remote attacker to obtain cross-origin data, which is data from a different origin than the one serving the page, by using a...

PT-2026-106826

Name of the Vulnerable Software and Affected Versions Quasar Framework versions 1.0.0 through 3.2.9 Description The @quasar/app-vite component recursively removes the resolved build.distDir before the build process begins. It fails to reject the project root, user home directory, filesystem roots...

PT-2026-106933

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in DevTools allows a remote attacker to leak cross-origin data through the use of a crafted HTML page and social engineering. Recommendations Update Google Chrom...

PT-2026-106950

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the Animation component that allows a remote attacker to leak cross-origin data by using a crafted HTML page. Cross-origin data leakage occurs when a websi...

PT-2026-106926

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in Extensions allows a remote attacker to obtain cross-origin data through the use of a crafted Chrome extension. Cross-origin data refers to information belongi...

PT-2026-106885

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in the Scroll feature allows a remote attacker to obtain cross-origin data, which is information from a different origin than the one serving the current page,...

PT-2026-106897

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Google Lens allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page. Cross-origin data refers ...

PT-2026-107064

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the WebAudio component. A remote attacker can potentially leak cross-origin data, which refers to data belonging to a different origin domain, protocol, or...

PT-2026-107070

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using a...

PT-2026-106888

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A race condition in WebAudio allows a remote attacker to potentially leak cross-origin data through the use of a crafted HTML page. A race condition occurs when the timing or order of...

PT-2026-106892

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Google Lens allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Cross-origin data leakage...

PT-2026-107026

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Improper resource exposure in Extensions allows a remote attacker to obtain cross-origin data through the use of a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-107066

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incomplete cleanup in Glic allows a remote attacker to leak cross-origin data through the use of a crafted HTML page and social engineering. Recommendations Update Google Chrome to...

CVE-2026-106339: Operation on a Resource after Expiration or Release

Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-104385: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...

CVE-2026-94293: Missing Authentication for Critical Function

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...