EUVD-2026-110708

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-85299

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August...

CVE-2025-8088-BUILDER-Winrar-Tool

CVE-2025-8088 WinRAR path traversal tool ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. A Python script that exploits CVE-2025-8088, a path traversal vulnerability in WinRAR, by generating a malicious archive tha...

EUVD-2026-110641

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August...

CVE-2026-107472

The Qt 5 Compatibility APIs module (specifically Qt Core in Qt 5 and earlier) contains an out-of-bounds read vulnerability within the QTextCodec TSCII encoding . This flaw occurs when applications convert text to the TSCII encoding via QTextCodec , potentially allowing the software to read memory...

CVE-2026-107472 Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to...

chromium-browser: angle: ANGLE in Google Chrome: Cross-origin data disclosure via uninitialized resource

A flaw was found in ANGLE in Google Chrome. An uninitialized resource vulnerability exists that allows a remote attacker to potentially obtain cross-origin data by enticing a user to visit a crafted HTML page...

chromium-browser: skia: chromium-browser: skia: Cross-origin data leakage via uninitialized use

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data...

chromium-browser: angle: ANGLE: Information disclosure via uninitialized resource

A flaw was found in ANGLE, a component used by Google Chrome. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to obtain sensitive cross-origin data, leading to information disclosure...

webkitgtk: Visiting a maliciously crafted website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a malicious website may lead to a sensitive data leak due to improper validation checks...

EUVD-2026-110606

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

CVE-2026-117472

Psono Server CE && EE versions 4.0.33 through 7.2.3 are vulnerable to an authorization bypass due to incorrect path comparison for the bulk-secret-read endpoint. When configured with URL_PREFIX , the application compares the request path against a hard-coded unprefixed path, causing the compariso...

CVE-2026-117472 URL prefix handling permits API key read-scope bypass in Psono Server

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

CVE-2026-99055

A flaw was found in the Linux kernel's TCP networking subsystem. When handling zero-copy data reception involving certain device memory buffers, the kernel fails to properly validate memory fragment types before dereferencing them, resulting in a null pointer dereference. An attacker sending...

CVE-2026-116741

A flaw was found in speex. An out-of-bounds write vulnerability exists due to improper buffer length handling when decoding byte streams into external memory buffers. A remote attacker could exploit this flaw by streaming specially crafted audio data into an affected application, triggering memor...

CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

CVE-2026-116486

A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion...

CVE-2026-116748

A flaw was found in Transmission. This vulnerability allows a remote attacker to execute arbitrary code, modify application settings, or delete data by exploiting an overly permissive Cross-Origin Resource Sharing CORS policy in the remote procedure call RPC server. By tricking a user into visiti...

CVE-2026-116580

A flaw was found in seroval. During deserialization, the process of converting serialized data back into live objects, the library fails to properly validate internal stream sources. A remote attacker can exploit this issue by supplying crafted input that reuses object identifiers, causing the...