CVE-2026-64604

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU...

EUVD-2026-53790

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU...

CVE-2026-64604 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU...

hosts v3.16.104

!IMPORTANT Cloning this repository can take a long time! You probably just want to start with the latest version, not its whole history since 2018. Therefore you probably want to use git clone --depth 1 ... to save significant time. !NOTE With the exception of issues and PRs regarding changes to...

CVE-2026-19165: Use After Free

Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: High...

PT-2026-68773

Name of the Vulnerable Software and Affected Versions pymdown-extensions versions prior to 11.0.1 Description Four inline processors caret, tilde, betterem, and magiclink use regular expressions that can cause catastrophic backtracking—a condition where the regex engine takes an exponential amoun...

CVE-2026-67422: Inefficient Regular Expression Complexity

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

PT-2026-68710

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description A use after free issue exists within the Extensions component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. An...

CVE-2026-61632: Improper Limitation of a Pathname to a Restricted Directory

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Command Injection

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Command Injection in the DevTools embedder handler. An attacker can execute arbitrary files outside the sandbox by leveragi...

GHSA-F2R8-JV7C-XQMP Electron: DevTools embedder handler executes arbitrary files via shell open

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70602

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

Exposure of Data Element to Wrong Session

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scoped to the...

Electron: Extension tab APIs operate across session boundaries

Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...

CVE-2026-70602 Electron: Extension tab APIs operate across session boundaries

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 an...