CVE-2026-84353: Use After Free

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

Google Chrome on Android (prior to version 152.0.7977.75 ) is vulnerable to a use-after-free (UAF) flaw in Shared Tab Groups . This vulnerability allows a remote attacker to leverage social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is rat...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-84470

A permission-check inconsistency in Ansible Automation Platform 's automation-controller (AWX) allows an execution-placement authorization bypass . The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) validates requested instance_groups at only a read-level permission, whereas the standard sin...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-46603

A flaw was found in golang.org/x/image/vp8l. A remote attacker can cause a denial of service by providing a specially crafted VP8L image. This image, containing many unused Huffman tree groups, leads to excessive memory allocation during VP8L decoding, resulting in memory exhaustion. Mitigation...

PT-2026-84563

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A use after free issue exists in Shared Tab Groups. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by inducing a user to visi...

PT-2026-84517

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller AWX affected versions not specified Description An authorization flaw exists in the Bulk Job Launch API endpoint 'POST /api/v2/bulk/job launch/'. The system performs only a read-level permissio...

Google Chrome < 152.0.7977.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 152.0.7977.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 202609stable-channel-update-for-desktop advisory. - Use after free in Shared Tab Groups in Google Chrome on on Android prior to...

BIT-KEYCLOAK-2026-16108 Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

CVE-2026-82633

Dolibarr versions 10.0.0 through 23.x fail to perform per-object authorization checks in the Users::getGroups REST API endpoint (GET /users/{id}/groups). Any authenticated user can call this endpoint with arbitrary user identifiers to retrieve group memberships, entity associations, and private n...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82562

CVE-2026-82562 affects the qs Node.js querystring parser (v6.14.2 through v6.15.3). When qs.parse is called with both comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is wrapped as a single nested element before the arrayLimit check runs, ...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Babel (@babel/helpers) (CVE-2025-27789)

Summary A ReDoS and performance degradation vulnerability in Babel CVE-2025-27789 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading @babel/helpers to versions 7.27.4 and 7.29.2. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next...

CVE-2026-54552

A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child...

BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

Information Disclosure

Keycloak is vulnerable to information disclosure. The vulnerability is due to insufficient authorization checks in the default-groups REST endpoint and realm representation, which allows a delegated administrator with realm-viewing permissions to access the names and identifiers of hidden default...