Chromium CVE-2026-95382: Improper input validation in Auth

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95276: Improper input validation in Themes

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95381: Improper input validation in Printing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

BIT-GITLAB-2026-13210 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-79015

A flaw was found in ServiceWorker in Google Chrome. A remote attacker could exploit improper input validation by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...

CVE-2026-79251

A flaw was found in Google Chrome. Improper input validation in the Network component allows a remote attacker to potentially bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page. The web origin policy is a critical security mechanism that...

OESA-2026-4049 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4048 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4046 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4047 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

CVE-2026-63206: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-100187: Improper Input Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

CVE-2026-67234: Improper Input Validation

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

Containerd CRI Plugin Arbitrary Command Execution

The vulnerability of the mechanism for processing container configuration tags in the CRI-plugin for Containerd is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-84462: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents cou...

EUVD-2026-86280

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2025-32000

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

Improper Input Validation

Apache ActiveMQ is vulnerable to improper input validation. The vulnerability is due to insufficient validation of the clientId when removing a durable topic subscription, which allows an authenticated attacker to spoof a client ID and potentially remove another client's durable topic subscriptio...