PT-2026-88739

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue exists in WebPackaging. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attacker who...

PT-2026-88747

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An uninitialized resource in the GPU allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. Recommendations...

PT-2026-88718

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An incorrect reference resolution in Storage on Windows allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by...

PT-2026-99449

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description The software fails to apply host-side Promise rejection handling within the sandbox-to-host construct trap. In the BaseHandler component, the apply trap utilizes the markHostPromiseHandled function to...

PT-2026-88463

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

PT-2026-87106

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed...

CVE-2026-82061: Use After Free

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...

PT-2026-88744

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Views on Windows allows a remote attacker to potentially execute arbitrary code outside the sandbox. This occurs if the attacker has already compromised the...

CVE-2026-78625: Improper Control of Generation of Code

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

PT-2026-88453

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value...

PT-2026-86949

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

PT-2026-88533

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A race condition exists in the FileAPI. This allows a remote attacker who has already compromised the renderer process to bypass site isolation, which is a security mechanism used to...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-88571

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the ServiceWorker allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a...

PT-2026-88706

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in SiteIsolation allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a...

PT-2026-88535

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ControlledFrame component. A remote attacker who has already compromised the renderer process can obtain sensitive information by using a specially...

PT-2026-88532

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Navigation allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations Update Google...

PT-2026-88585

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker...

CVE-2026-78971

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

PT-2026-88602

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Fullscreen feature allows a remote attacker to spoof UI elements using a crafted HTML page. This requires the attacker to have already compromised the...