PT-2026-97558

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.17 RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.6 Description In the management plugin, the match origin/1 function within rabbit mgmt cors.erl incorrectly...

CVE-2026-67405: Missing Origin Validation in WebSockets

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

PT-2026-105052

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmq web mqtt/src/rabbit web mqtt handler.erl:104 nor the Web-STOMP handler deps/rabbitmq web stomp/src/rabbit web stomp handler.erl:102 validates the...

PT-2026-97587

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description The Web-MQTT handler and the Web-STOMP handler do not validate...

Linux Distros Unpatched Vulnerability : CVE-2026-91740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-91719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-91732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged...

Linux Distros Unpatched Vulnerability : CVE-2026-91730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged soci...

Linux Distros Unpatched Vulnerability : CVE-2026-91708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-91747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data vi...

Linux Distros Unpatched Vulnerability : CVE-2026-91746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-86805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker t...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

EUVD-2026-84873

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912

A stored cross-site scripting (XSS) vulnerability exists in GitHub Enterprise Server within the Markdown rendering pipeline . The flaw occurs because the pipeline rewrote quote characters in already-sanitized HTML without performing subsequent re-sanitization, allowing an authenticated attacker t...

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-93383

A flaw was found in Google Chrome. This vulnerability, an information leak in the Permissions component, allows a remote attacker to leak cross-origin data. Exploitation occurs when a user visits a specially crafted HTML page, leading to unauthorized disclosure of sensitive information...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...