PT-2026-95078

Name of the Vulnerable Software and Affected Versions SAIL versions prior to 1.0.0 Description A heap overwrite occurs in the sail codec load frame v8 xbm function within src/sail-codecs/xbm/xbm.c when processing X10 static short files. The issue arises because the decoded pixel buffer is allocat...

CVE-2026-93378: Missing Authorization

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-93393: Out-of-bounds Write

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming...

CVE-2026-50291: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

CVE-2026-93380: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-92954: Uncaught Exception

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

PT-2026-105468

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny...

CVE-2026-92934: Protection Mechanism Failure

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

Angie -- worker process memory corruption when using HTTP/3

The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or earlier, if the default server for the address that accepted a regular HTTPS request also used HTTP/3 the listen directive with the quic parameter, possibly on a different port, while a server...

PT-2026-94377

Name of the Vulnerable Software and Affected Versions BlueKitchen BTstack versions prior to 1.8.3 Description An issue exists in A2DP stream endpoint discovery where the software fails to validate the peer-reported endpoint count against table bounds. A bonded peer can send an AVDTP DISCOVER...

PT-2026-94302

Name of the Vulnerable Software and Affected Versions google-protobuf affected versions not specified Description The software contains an unbounded recursion issue when parsing unknown protobuf group fields. An attacker can send a crafted payload consisting of deeply nested START GROUP wire byte...

PT-2026-94755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath11k wmi process csa switch count event function. This happens because there is no policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

PT-2026-95018

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.26 through 2.44 Description Initializing the DNS stub resolver using a LOCALDOMAIN environment variable or an /etc/resolv.conf file containing a search list with a domain of approximately 200 characters or more causes ...

PT-2026-94756

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath12k wmi process csa switch count event function. This is caused by the absence of a policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

CVE-2026-92956: Protection Mechanism Failure

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-92955: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

Fortinet FortiClient Arbitrary process termination from exposed minifilter communication port (FG-IR-26-165)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-165 advisory. - A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all...

PT-2026-105025

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size t underflow in amqp handle input in librabbitmq/amqp connection.c. The parser subtracts HEADER SIZE, fixe...

PT-2026-94925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dell-wmi-base component where the handling of the ultra performance key is incorrect. The dell wmi process key function uses an incorrect index when accessing the...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...