PT-2026-106988

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the Modularization component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

CVE-2026-106347: Use After Free

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-106942

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the CSS component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after...

PT-2026-106956

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Streaming component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-107013

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to potentially execute arbitrary code within the sandbox by...

PT-2026-106879

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the PDF component, which allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted PDF file. Use after free is ...

PT-2026-107007

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

CVE-2026-102165: Stack-based Buffer Overflow

On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...

PT-2026-107151

On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...

CVE-2026-105858: Improper Control of Generation of Code

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created...

PT-2026-106791

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description A crafted request to the public first-register operation allows remote code execution. This occurs when local authentication is enabled and no initia...

CVE-2026-43598: Untrusted Pointer Dereference

Improper input validation in the AMD ROCm Communication Collectives Library RCCL could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution...

CVE-2026-105857: Improper Control of Generation of Code

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

PT-2026-106715

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5 Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker t...

CVE-2026-106346: Improper Check for Unusual or Exceptional Conditions

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106443: Improper Input Validation

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript...

PT-2026-106921

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in Bindings, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use...

PT-2026-107065

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Storage component. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by...

PT-2026-107095

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-106914

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.39 Description Incorrect authorization in the Search component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This is achieved by leveraging social...