CVE-2026-84350

A flaw was found in Chromium's TabStrip component. A remote attacker could leverage social engineering techniques and user interface UI interaction to trigger a use-after-free vulnerability. This could lead to the execution of arbitrary code outside of the browser's sandbox...

CVE-2026-79090

A flaw was found in chromium-browser. Improper privilege management in the Actor component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

BIT-MILVUS-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-79028

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the network component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-79181

A flaw was found in Google Chrome. An observable discrepancy in the Glic component allows a remote attacker to obtain sensitive information. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-79088

A flaw was found in Google Chrome's FileSystem component. A remote attacker could exploit this vulnerability by leveraging social engineering techniques and a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, potentially leading to unauthorized acces...

CVE-2026-79179

A flaw was found in Chromium's Document Object Model DOM due to incorrect authorization. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could potentially lead to the leakage of sensitive information...

EUVD-2026-86873

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898

The Akia keyless entry cloud service contained an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization. The unlock action failed to validate client-supplied room or door identifiers against the authenticated guest's specific booking on the server-side. T...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-79018

A flaw was found in Chromium's FoldableAPIs. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive user information...

CVE-2026-79124

A flaw was found in Google Chrome on Android. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak through the improper handling of Intents, allowing the attacker to access sensitive user information...

CVE-2026-6085

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-79199

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, an attacker can gain unauthorized access within the network component...

CVE-2026-79017

A flaw was found in Chromium. A race condition in the Extensions component allows a remote attacker to bypass system access restrictions by using a specially crafted Chrome extension. This could lead to unauthorized access to system resources...

CVE-2026-79099

A flaw was found in Google Chrome's Network component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, leading to unauthorized access or actions within the affected...

CVE-2026-6086 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

EUVD-2026-86620

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...