CVE-2026-68132

A flaw was found in the Linux kernel. A deadlock can occur during the emergency thaw process of frozen block devices. This issue arises when the dothawallcallback function attempts to reacquire a lock it already holds exclusively, while also holding another mutex. This deadlock prevents further...

CVE-2026-19160

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the disclosure of sensitive cross-origin data. Mitigation...

Malicious code in @nzeros/codebreak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-- as its compiled output. The darwin-arm6...

CVE-2026-73070 Vim: Stack Buffer Overflow in the Vim Socket Server

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...

CVE-2026-73067

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

CVE-2026-19176

A flaw was found in Skia, a 2D graphics library. A remote attacker, who has already compromised the renderer process, could exploit a use-after-free vulnerability by providing a specially crafted HTML page. This could lead to the execution of arbitrary code within the sandbox environment,...

CVE-2026-19161

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data. Mitigation Mitigation for thi...

CVE-2026-19154

An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=532941869 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-19148

A flaw was found in the GPU component of Google Chrome on Linux. A remote attacker, who has already compromised the renderer process, could exploit an out-of-bounds write vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to...

CVE-2026-19137

A flaw was found in Google Chrome on Android. This vulnerability, a use-after-free error in the WebGL component, could be exploited by a remote attacker. After compromising the renderer process, the attacker could craft a malicious HTML page to trigger the flaw. This could potentially lead to a...

CVE-2026-73067

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

CVE-2026-73067 Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

EUVD-2026-56182

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

CVE-2026-73067

CVE-2026-73067 affects the Tesseract OCR engine. A crafted .traineddata model loaded via TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg to accept an unterminated forward-edge run, leading to SquishedDawg::Load calling num_forward_edges(0) and last_edge reading beyond edges_, which t...

CVE-2026-48046

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...

CVE-2026-48056

Streambert (Electron desktop app) versions prior to 2.5.0 are vulnerable due to improper validation of executable paths in the run-download IPC handler, enabling a compromised renderer to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 patches this. No exploitati...

EUVD-2026-56146

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...

CVE-2026-48046

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...

CVE-2026-48046 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...