CVE-2026-102300: Use of Uninitialized Resource

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

PT-2026-102833

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description An uninitialized resource in WebGPU allows a remote attacker to obtain cross-origin data by using a crafted HTML page. WebGPU is a modern API that provides high-performance graphics and...

CVE-2026-95368: Incorrect Authorization

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-76731: Improper Privilege Management

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes...

CVE-2026-102303: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

PT-2026-102422

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Authenticated attackers can read private comments from tickets belonging to other users without proper authorization. This occurs because the application fails to validate ticket ownership when...

Oracle Linux 10 : openssh (ELSA-2026-69129)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69129 advisory. - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 -...

PT-2026-102800

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Command injection exists in the certificate export CLI functionality. A privileged authenticated CLI user can exploit this weakness to execute arbitrary commands with root privileges...

CVE-2026-84154: Improper Control of Generation of Code

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95289): chromium -- security fixes

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95289: Incorrect Authorization

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95296: Missing Authorization

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102713: Out-of-bounds Read

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-95317: Incorrect Authorization

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-84440: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter service, which runs...

CVE-2026-84436: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-84842: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

ROS-20260929-73-0114

The vulnerability of the pnfsmarklayoutstateidinvalid function in the fs/nfs/pnfs.c module relates to errors during link counters updates in Linux kernel-based NFS client support. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of...