Enterprise component Google Chrome Microsoft Edge Data Compromise

The vulnerability in the Enterprise component of Google Chrome and Microsoft Edge web browsers is related to a lack of secure information protection mechanisms. Exploitation of this vulnerability could allow a remote attacker to compromise the integrity of protected information...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792600325)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792600325 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...

Global Media Controls Component Compromise

The vulnerability in the Global Media Controls component of Google Chrome and Microsoft Edge web browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected data by...

Payments Component Data Compromise

The vulnerability in the Payments component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially...

Linux kernel Architecture Data Compromise

The vulnerability in the components arch/mips/bmips/setup.c and arch/mips/bmips/dma.c of the Linux operating system’s kernel is related to the implementation of an incorrect control flow. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Payments Component Data Compromise

The vulnerability in the Payments component of Google Chrome and Microsoft Edge stems from insufficient input validation. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Google Chrome ServiceWorker Data Compromise

The vulnerability in the ServiceWorker interface of Google Chrome and Microsoft Edge is related to authorization errors. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Google Chrome Microsoft Edge Data Compromise

The Headless mode vulnerability in Google Chrome and Microsoft Edge is related to a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Linux run_get_highest_vcn() Data Compromise

The vulnerability of the rungethighestvcn function in the Linux operating system is related to the improper implementation of the control flow. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux CIFS misc Component Data Compromise

The vulnerability of the fs/cifs/misc.c component in the Linux operating system is related to the implementation of an incorrect control flow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Spring Framework 5.3.17 / 5.2.19 Remote Code Execution

Spring Framework versions 5.3.17 and 5.2.19 contain a remote code execution vulnerability through data binding. The report describes affected deployment conditions, fixed releases, defensive controls, and incident response guidance...

PT-2026-120524

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPER USER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USE PIPE or MAINTAIN who does NOT have WRITE DATA or DELETE DATA permissions on target databas...

PT-2026-120850

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Splunk Secure Gateway versions prior to 3.10.12 Splunk Secure Gateway...

PT-2026-120511

Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2...

PT-2026-122079

Name of the Vulnerable Software and Affected Versions Little Birdies versions prior to 1.3.17 Description ThemeREX Group Little Birdies allows Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequenc...

PT-2026-121795

Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.6 Description Deserialization of untrusted data in the xnau webdesign Participants Database allows for Object Injection. This occurs when the application deserializes data from an untrusted source...

PT-2026-122072

Name of the Vulnerable Software and Affected Versions ThemeREX Group Helion versions prior to 1.1.13 Description An issue exists due to the deserialization of untrusted input, which allows unauthenticated attackers to perform PHP Object Injection. While no POP chain a sequence of gadgets used to...

Apache IoTDB security vulnerabilities

A security vulnerability exists in Apache IoTDB versions 2.0.0 through 2.0.11. This vulnerability arises because the Legacy Pipe receive protocol handshake/sendPipeData utilizes a hard-coded SUPERUSER root identity for data loading and deletion operations. Users possessing only SYSTEM-level...

PT-2026-120207

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

PT-2026-120878

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.2 through 19.3.5 GitLab EE versions 19.4 through 19.4.2 GitLab EE versions 19.5 through 19.5.0 Description Insufficient granularity of admin-lock enforcement controls allows an authenticated user with group Owner...