40334 matches found
CVE-2026-17107: Unintended Proxy or Intermediary
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...
ROS-20260724-73-0014
The vulnerability of Google Chrome’s V8 JavaScript engine lies in the access to resources through incompatible types. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information...
CVE-2026-14172: Execution with Unnecessary Privileges
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...
CVE-2026-15346: Improper Neutralization of Input During Web Page Generation
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-15401: Improper Neutralization of Input During Web Page Generation
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-68719
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description An integer overflow exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within a sandbox by enticing a user to...
CVE-2026-16355
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
nginx: Fix of CVE-2026-42533
CVE-2026-42533: fix heap buffer overflow in the map directive with regex matching script engine buffer overrun protection...
Important: Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-59936 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-59936 Source advisory: OSV:GHSA-5XF7-4P34-54QR...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-59937 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-59937 Source advisory: OSV:GHSA-55H5-XMCQ-C37V...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-59938 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-59938 Source advisory: OSV:GHSA-5QJQ-93H5-HRGP...
PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection
Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
In ANGLE, reading outside the bounds of the allowed area in Google Chrome on Linux before version 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in V8 in Google Chrome before 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...