SUSE CVE-2026-7666

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when failsilently=True, which allows on-path network attackers to read ema...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Tuzitio Camaleon_Cms

HTB Facts — Full Writeup Difficulty: Medium OS: Lin...

cabrnet (1.1.0), lisa-on-cuda (1.2.0) potentially affected by CVE-2026-10783 via gradio (4.33.0)

gradio PYPI version 4.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cabrnet 1.1.0 - lisa-on-cuda 1.2.0 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-10783 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.1.0, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-10783 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

cabrnet (1.1.0), lisa-on-cuda (1.2.0) potentially affected by CVE-2026-10783 via gradio (4.33.0)

gradio PYPI version 4.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cabrnet 1.1.0 - lisa-on-cuda 1.2.0 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2026-10783 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-10783 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.1.0, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

PT-2026-46487

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 149.0.7827.53 Description A use after free issue exists where a remote attacker can execute arbitrary code. This is achieved by convincing a user to perform specific UI gestures while interacting with a...

CVE-2026-11148: Cross-Site Request Forgery (CSRF)

Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11007: Improper Input Validation

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-10961: Use After Free

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-10885: Use After Free

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Critical...

PT-2026-46317

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the ChartDatasetConfig.legend field. The...

PT-2026-46888

Name of the Vulnerable Software and Affected Versions Shopware versions 6.7.3.0 through 6.7.10.0 Description An open redirect exists in the public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is accessed without the expected SSO session state, the application uses the Referer...

PT-2026-46812

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 149.0.7827.53 Description An inappropriate implementation in Chrome for iOS allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by...

PT-2026-46690

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description A use after free issue in Messages allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw...

CVE-2026-11025: Client-Side Enforcement of Server-Side Security

Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-10958: Use After Free

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-48480: Missing Cryptographic Step

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversar...