CVE-2026-12303 Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component

Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

EUVD-2026-37064

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...

CVE-2026-8484 Heap buffer overflow in Jansi

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...

wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark

A flaw was found in the USB HID dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an excessive consumption of memory, resulting in a denial of service...

Chromium: CVE-2026-11698 Use after free in Bluetooth

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-11660 Insufficient validation of untrusted input in New Tab Page

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-49712

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14 through 4.4.0 Description A use-after-free issue exists in the native IPv4 stack within the icmpv4 handle echo request function in subsys/net/ip/icmpv4.c. The function creates an echo-reply packet and passes it to net try...

PT-2026-53032

Impact The Public API endpoint for retrying executions authorized access using workflow:read rather than workflow:execute. An authenticated user with read-only access to a shared workflow could use the Public API to retry executions of that workflow, bypassing the intended permission boundary...

PT-2026-49711

subsys/net/ip/icmpv6.c reads the network interface from a net pkt after that packet has been handed to net try send data. In icmpv6 handle echo request and net icmpv6 send error, the post-send statistics update calls net pkt ifacereply/net pkt ifacepkt on the just-sent packet. The send path net t...

PT-2026-49713

Zephyr's IPv6 Neighbor Discovery send paths net ipv6 send na, net ipv6 send ns, net ipv6 send rs in subsys/net/ip/ipv6 nbr.c updated the per-interface ICMP-sent statistics by calling net pkt ifacepkt after net send datapkt had already returned successfully. On the success path the network stack...

PT-2026-49793

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the PostWipeData function of recovery ui.cpp may cause data persistence after a factory reset. This issue allows for local information disclosur...

PT-2026-54132

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.47 Description A use after free issue exists in Ozone, which is a platform-agnostic abstraction layer for windowing and input. This flaw allows a remote attacker to execute arbitrary code via...

PT-2026-57550

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.8 Description The Docker API server contains credential exfiltration flaws due to improper input validation and insecure configuration handling. Unauthenticated attackers can redirect LLM API calls to external...

PT-2026-50132

Name of the Vulnerable Software and Affected Versions Backpropagate versions 1.1.0 through 1.1.1 Description The optional Reflex web UI exposes a training control plane without authentication, despite CLI flags --auth and --share suggesting that security controls are active. The Reflex backend...

CVE-2026-46448

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation...

PT-2026-49824

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.5 Description Improper access control in the social login connection endpoint allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized by using a crafted A...

PAN-OS Management Web Interface Code Execution Root Privileges

The vulnerability of the Management Web Interface component of the PAN-OS operating system relates to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code with root...

EUVD-2026-36928

Unauthenticated Cross Site Scripting XSS in Contact Form to Any API = 3.0.3 versions...

EUVD-2026-36750

Ruoyi 4.8.2 is vulnerable to Cross Site Scripting XSS at the interface /system/notice/add...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the unauthenticated /.well-known/appspecific/com.chrome.devtools.json endpoint, which exposes the absolute filesystem path of the project and a persistent...