PT-2026-86949

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

CVE-2026-78625: Improper Control of Generation of Code

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-86564: Out-of-bounds Read

A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

CVE-2026-58234: Improper Restriction of Recursive Entity References in DTDs

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

PT-2026-99449

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description The software fails to apply host-side Promise rejection handling within the sandbox-to-host construct trap. In the BaseHandler component, the apply trap utilizes the markHostPromiseHandled function to...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

EUVD-2026-74262

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

PT-2026-88463

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

CVE-2026-9034: Use After Free

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed...

CVE-2026-78971

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

PT-2026-88672

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An injection issue in DevTools allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page...

PT-2026-88534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker wh...

PT-2026-88539

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ServiceWorker, which allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page...

PT-2026-88572

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in FedCM Federated Credential Management, an API that allows users to sign into websites using their existing accounts from other providers allows a remote...

PT-2026-88599

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation ...

PT-2026-88605

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolatio...

PT-2026-88610

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in the FileAPI allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted...

PT-2026-88624

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue in Core allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page...

PT-2026-88638

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A clickjacking issue in the Input component allows a remote attacker to spoof UI elements using a crafted HTML page. This exploitation requires the attacker to have already compromised...

PT-2026-88680

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in WebAppInstalls allows a remote attacker to bypass site isolation using a crafted HTML page. This requires the attacker to have already compromised the rendere...