CVE-2026-106226: Improper Input Validation

Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106414: Improper Input Validation

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106443: Improper Input Validation

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript...

CVE-2026-106263: Improper Input Validation

Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106206: Improper Input Validation

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106185: Improper Input Validation

Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106299: Improper Input Validation

Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106494: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that...

CVE-2026-106491: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106490: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

PT-2026-107003

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Improper input validation in Extensions allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can...

PT-2026-107271

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 2.2.4 Description The @backstage/plugin-techdocs-backend package contains improper input validation during static content requests. When the Azure Blob Storage provider is utilized and entity-level permissions are...

Cisco ASA Basic XSS (CVE-2024-20382)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

Cisco ASA Improper Input Validation (CVE-2020-3166)

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted...

Cisco ASA Improper Input Validation (CVE-2022-20715)

A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to...

Cisco ASA Stack-based Buffer Overflow (CVE-2021-40118)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition. This vulnerability is due to improper input validation when...

PT-2026-107279

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...

PT-2026-107086

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 155.0.8059.39 Description Improper input validation allows a remote attacker to potentially execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to entice a user t...

PT-2026-107332

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper input validation allows a remote authenticated attacker to execute arbitrary code. Recommendations Update IBM Langflow OSS to a version later than 1.12.2...

PT-2026-107248

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-sentry versions 0.3.0 through 0.3.7 Description Improper input validation in sentry scaffolder actions allows an authenticated internal user to force the backend to contact unintended destinations...