PT-2026-107066

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incomplete cleanup in Glic allows a remote attacker to leak cross-origin data through the use of a crafted HTML page and social engineering. Recommendations Update Google Chrome to...

PT-2026-106933

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in DevTools allows a remote attacker to leak cross-origin data through the use of a crafted HTML page and social engineering. Recommendations Update Google Chrom...

CVE-2026-106354: Exposure of Resource to Wrong Sphere

Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106859

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in the Media component allows a remote attacker to obtain cross-origin data, which is data from a different origin than the one serving the page, by using a...

CVE-2026-106109: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106106: Improper Neutralization of Input During Web Page Generation

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106180: Observable Discrepancy

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106184: Use of Uninitialized Resource

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-107298

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains a sensitive information exposure issu...

CVE-2026-106360: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107232

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x Description Improper neutralization of null bytes or NUL characters in the OutputDebugStringAppender allows logged content to be truncated. When a NUL character is present, the debug output record en...

CVE-2026-106455: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106277: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106392: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102406: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

PT-2026-107156

Name of the Vulnerable Software and Affected Versions Kibana versions 8.14.0 through 8.19.21 Kibana versions 9.0.0 through 9.4.6 Kibana versions 9.5.0 through 9.5.3 Description An authorization bypass exists in the Fleet package installation process where a user with delegated package-management...

PT-2026-107157

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Incorrect authorization allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized to access. This is achieved by using the Modi...

PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

CVE-2026-106585: Improper Handling of Highly Compressed Data (Data Amplification)

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

Linux Distros Unpatched Vulnerability : CVE-2026-98298

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the...