CVE-2026-95276: Improper Input Validation

Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95278: Missing Authorization

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95285): chromium -- security fixes

Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-97029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox...

Uncontrolled Recursion

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncontrolled Recursion via the load method in jwt/apijws.py when parsing a JWT with a deeply nested recursive JSON structure in the header. An attacker can supply a JWT whose header contains...

CVE-2026-102296 ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized stat...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102006

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

EUVD-2026-88548

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

CVE-2026-102006 VxWorks 7 Memory allocation

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

CVE-2026-102006

Wind River VxWorks 7 prior to version 26.09 is vulnerable to a memory management flaw where specific system call arguments cause the process management subsystem to fail to release allocated kernel memory before an application terminates. This can lead to a high availability impact as kernel memo...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into t...

CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

UBUNTU-CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...

EUVD-2026-85327

scim-patch: Mutation of Inherited Built-in Method Objects...

scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...