CVE-2026-113186

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution outside the browser sandbox by tricking a user into visiting a specially crafted HTML webpage. This vulnerability is caused by a memory corruption error in the Developer Tools DevTools component. If...

CVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

CVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

CVE-2026-113185

A flaw was found in the Extensions component of chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox. An attacker could exploit this memory corruption issue by convincing a user to visit a specially crafted HTML page...

CVE-2026-113176

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to visit a crafted HTML page. Successful exploitation causes memory corruption in the browser address bar Omnibox, which may allow the attacker to execute arbitrary code within the restrict...

CVE-2026-113184

A flaw was found in the Scheduling component of chromium-browser. A remote attacker could exploit this memory corruption vulnerability by convincing a user to visit a specially crafted HTML page. Successful exploitation may allow an attacker to execute arbitrary code within the browser sandbox an...

CVE-2026-113183

A flaw was found in the Federated Credential Management FedCM component of chromium-browser. This memory corruption vulnerability allows a remote attacker to potentially execute arbitrary code within the browser sandbox by convincing a user to visit a crafted HTML page. Successful exploitation...

CVE-2026-113182

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from memory corruption within the Passwords component...

CVE-2026-113180

A flaw was found in the ContentCapture component of Google Chrome on Android. This memory corruption vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox by enticing a victim to open a specially crafted HTML page...

CVE-2026-113172

A flaw was found in chromium-browser. A memory corruption vulnerability in the ServiceWorker component allows a remote attacker to execute arbitrary code within the browser sandbox by tricking a user into visiting a crafted HTML page. Successful exploitation compromises the browser's isolated...

CVE-2026-113169

A flaw was found in the WebAppInstalls component of Google Chrome on Android. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page, triggering memory corruption. Successful exploitation allows the attacker to execute arbitrary code outside o...

CVE-2026-113146

A flaw was found in chromium-browser. This flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox environment due to a memory corruption vulnerability in the Performance Application Programming Interfaces APIs. Exploitation is achieved by convincing a user to visit a...

CVE-2026-113171

A flaw was found in the Prompts component of Google Chrome. This vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser's restricted security environment sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from memory...

CVE-2026-113167

A flaw was found in the Chromium Network component. This vulnerability allows a remote attacker to potentially execute arbitrary code within the browser's restricted sandbox environment. By convincing a victim to load a specially crafted HTML page, an attacker can trigger a memory corruption...

CVE-2026-113118

A flaw was found in chromium-browser. A memory corruption vulnerability in the Extensions component allows a remote attacker to execute arbitrary code within the browser's sandbox an isolated security environment. An attacker could exploit this vulnerability by convincing a user to view a special...

kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

CLSA-2025-1761139764 kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...

CVE-2026-96638

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-96638

The Pillow Python imaging library (versions 9.1.0 through 13.0.0 ) is vulnerable to a memory-exhaustion denial of service due to a flaw in the BmpRleDecoder.decode() function located in src/PIL/BmpImagePlugin.py. The root cause is the lack of a per-branch cap on crafted RLE BMP delta escapes and ...