CVE-2026-93380: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93378: Missing Authorization

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

PT-2026-94377

Name of the Vulnerable Software and Affected Versions BlueKitchen BTstack versions prior to 1.8.3 Description An issue exists in A2DP stream endpoint discovery where the software fails to validate the peer-reported endpoint count against table bounds. A bonded peer can send an AVDTP DISCOVER...

PT-2026-94755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath11k wmi process csa switch count event function. This happens because there is no policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

PT-2026-94756

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath12k wmi process csa switch count event function. This is caused by the absence of a policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

CVE-2026-92934: Protection Mechanism Failure

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

Fortinet FortiClient Arbitrary process termination from exposed minifilter communication port (FG-IR-26-165)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-165 advisory. - A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all...

PT-2026-94925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dell-wmi-base component where the handling of the ultra performance key is incorrect. The dell wmi process key function uses an incorrect index when accessing the...

Angie -- worker process memory corruption when using HTTP/3

The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or earlier, if the default server for the address that accepted a regular HTTPS request also used HTTP/3 the listen directive with the quic parameter, possibly on a different port, while a server...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

Malicious Package

Overview process-mite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-20135

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

CVE-2026-86089

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-82561

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-20135 Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

CVE-2026-20135 Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

EUVD-2026-81123

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

CVE-2026-20135

Cisco Secure Firewall Threat Defense (FTD) Software is vulnerable to a denial of service (DoS) via its TLS 1.3 implementation . The root cause is improper buffer management during TLS 1.3 connections. An unauthenticated, remote attacker can trigger a DoS by sending a crafted TLS 1.3 packet to a T...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...