Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the GPU component of Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform a denial-of-service attack through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Skia in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out-of-bounds memory write via a crafted print file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the USB mechanism of Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Media section of Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

EUVD-2026-47924

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'brbrandtooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

RLSA-2026:41899 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18...

EUVD-2026-47878

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

PT-2026-63966

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists where unauthorized input injection is possible during a Remote Development session. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63590

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-63983

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 5.0.8 Description An issue exists that allows a denial of service via memory exhaustion. The expand function limits the number of results using a max option, but it does not restrict the length of each...