PT-2026-66189

Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic. Chromium security severity: Medium...

PT-2026-66226

Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-17903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML...

The vulnerability of the nfs_match_client() function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the nfsmatchclient function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, is related to authentication errors. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the automatic update mechanism of PC ViPNet administrators, related to deficiencies in handling relative paths, allows a perpetrator from a neighboring trusted network to compromise the integrity of the operating environment of the target node by using a specially crafted update package, delivered on behalf of the compromised trusted node with the role of Network Management Center (NMC).

The vulnerability of the automatic update mechanism of PC ViPNet Administrator is related to deficiencies in the processing of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating environmen...

Linux Distros Unpatched Vulnerability : CVE-2026-17856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to...

Linux Distros Unpatched Vulnerability : CVE-2026-17774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...

CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7

CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7. A patched version of the package is available...

CVE-2026-67424 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

UBUNTU-CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

UBUNTU-CVE-2026-59920

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...

CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

CVE-2026-59920

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-8497

CVE-2026-8497 describes an issue in Devolutions Password Manager (versions up to 2026.2.1.0) where Devolutions Server connection handling performs improper certificate validation on Android, iOS, and macOS. This allows an adjacent-network attacker to intercept and modify sensitive information thr...

EUVD-2026-50422

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-60113

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...