CVE-2026-73414

Shescape (JavaScript library) contains a vulnerability in getEscapeFunction (src/internal/win/cmd.js) where it fails to escape '(' and ')' when using escape/escapeAll on Windows with CMD or with shell: true when CMD is default. An attacker-controlled argument can break out of a parenthesized CMD ...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

[SECURITY] [DSA 6432-1] flatpak security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6432-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 12, 2026 https://www.debian.org/security/faq -...

SUSE CVE-2026-19556

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19557

Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19559

Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19560

Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-19560

A flaw was found in chromium-browser. A remote attacker could exploit a use-after-free vulnerability in the Blink component by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution within the sandbox environment, potentially compromising the affected...

CVE-2026-19175

A flaw was found in Google Chrome's Payments component. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to escape the browser's security sandbox, gaining unauthorized access to the...

CVE-2026-19173

A flaw was found in Skia, a 2D graphics library utilized within Chromium-based browsers. A remote attacker, having already compromised the browser's renderer process, could exploit an out-of-bounds write vulnerability. This exploitation occurs by enticing a user to visit a specially crafted HTML...

CVE-2026-19170

A flaw was found in Google Chrome's WebGL component. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to perform a sandbox escape, breaking out of the browser's security protections...

CVE-2026-19164

A flaw was found in Codecs in Google Chrome. Insufficient validation of untrusted input in this component could allow a remote attacker to exploit the vulnerability. By crafting a malicious HTML page, an attacker could potentially perform a sandbox escape, leading to the execution of arbitrary co...

CVE-2026-19151

A flaw was found in chromium-browser. A remote attacker could exploit a use-after-free vulnerability in the V8 JavaScript engine by crafting a malicious HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox, potentially leading to further system compromis...

CVE-2026-18171

CVE-2026-18171 affects Docker Sandboxes (sbx) where the read-only intent of a runtime host mount is applied only to the in-guest bind; the virtio-fs host-edge grant is added to the sandbox policy-share allowlist with no access mode. The result is that the directory remains writable at the shared-...

EUVD-2026-57236

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

Exploit for Out-of-bounds Write in Apple Ipados

CVE-2026-28956 Donate Support the maintenance of this pro...

firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...