CVE-2026-102371: Invocation of Process Using Visible Sensitive Information

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-95316: Unchecked Return Value

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. Chromium security severity: Low...

PT-2026-102850

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description Improper privilege management in Mojo, a Chromium IPC Inter-Process Communication framework, allows a local attacker to potentially execute arbitrary code outside the sandbox via a loca...

CVE-2026-79403: Improper Handling of Insufficient Permissions or Privileges

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

PT-2026-102626

Name of the Vulnerable Software and Affected Versions Pardus Parental Control versions prior to 0.7.0 Description An incorrect authorization issue exists in the polkit policy. This allows unprivileged local users to disable parental controls with root privileges. An attacker can execute the...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

Amazon Linux 2 : policycoreutils (ALAS-2026-3949)

The version of policycoreutils installed on the remote host is prior to 2.5-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3949 advisory. A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95302): chromium -- security fixes

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95298): chromium -- security fixes

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95316): chromium -- security fixes

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95358): chromium -- security fixes

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...

CVE-2026-76736: Improper Restriction of Operations within the Bounds of a Memory Buffer

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service...

SUSE CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-98051

A flaw was found in the Linux kernel's Broadcom ASP 2.0 Ethernet driver. When evaluating whether sufficient transmit buffer space is available for outgoing packets, the driver fails to properly verify all required consecutive descriptor slots. A local user could exploit this flaw by generating...

CVE-2026-97552

A flaw was found in the Linux kernel's XFS file system. An uninitialized variable in the deferred operation handling routine can cause the kernel to return an indeterminate value when processing empty work items during online repair. A local user initiating or interacting with file system repair...

CVE-2026-98045

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these...

CVE-2026-98044

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This issue allows a privileged local user to cause a Denial of Service DoS or unexpected program rejection by loading a specially crafted BPF program containing legacy packet-load instructions inside callback functions. D...

CVE-2026-98043

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier incorrectly assumes that certain pointer types are non-null without accounting for unbounded offsets that can wrap around to zero at runtime. A local user with permissions to load BPF programs can exploit thi...

CVE-2026-98040

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. When validating conditional jump operations using register comparisons against null values, the verifier fails to properly track register precision across different execution paths. A local user capable of loading BPF...