PT-2026-107065

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Storage component. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by...

PT-2026-107095

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-107029

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in WebRTC, which occurs when an application continues to use a pointer after it has been freed. This allows a remote attacker to execute arbitrary code...

CVE-2026-106349: Use After Free

Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-107021

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in V8, the open-source high-performance JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox ...

CVE-2026-106358: Use After Free

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4

Article Applicability All vulnerabilities listed in this article: Affect only Veeam Backup & Replication 12.3.2 P3 build 12.3.2.4854 and older builds. Are resolved in Veeam Backup & Replication 12.3.2 P4 build 12.3.2.4934. Do not affect any Veeam Backup & Replication version 13 builds. Customers...

CVE-2026-104711

Apache Struts has an OGNL expression-injection vulnerability in the legacy RESTful action mapper. A crafted request to an application configured to use this mapper may lead to remote code execution. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are n...

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- Usage Reverse shell listener with Ncat root@Kali:/TryHackme/Ice nc -nlvp 443 listening on any 443 ... connect to 192.168.92.128 from UNKNOWN 192.168.92.133 49211 Microsoft Windows Version 6.1.7601 Copyright c 2009 Microsoft...

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

EUVD-2026-91720

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution...

GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution vulnerability discovered by ? in WordPress Npm tinypool versions = 2.1.0...

GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

EUVD-2026-81584

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit...

EUVD-2026-45272

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass...

EUVD-2026-91120

Langflow: Title Authenticated Remote Code Execution in validatecode via Malicious Decorators Description...

GHSA-W584-2H2R-2HVF Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...