Google Chrome ViewTransitions Unauthorized Access

The vulnerability of the ViewTransitions component in Google Chrome browser is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

fetch library axios Data Compromise

The vulnerability of the axios library’s fetch adapter is related to the unlimited distribution of resources. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected information...

axios Uncontrolled Resource Consumption

The vulnerability of the axios library is related to an uncontrolled resource consumption when processing the maxBodyLength parameter. Exploiting this vulnerability could allow a remote attacker to compromise the accessibility of the protected information...

Google Chrome Downloads Spear Phishing

The vulnerability of the Downloads component in the Google Chrome browser is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

Google Chrome Use-After-Free

The vulnerability of Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Google Chrome Navigation Unauthorized Access

The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Google Chrome Fullscreen Spoofing

The vulnerability of Google Chrome’s fullscreen mode is related to errors in information representation by the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

Google Chrome GPU DoS

The vulnerability of Google Chrome’s GPU component is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

SiteIsolation Component DoS

The vulnerability of Google Chrome’s SiteIsolation component is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Google Chrome DoS

The vulnerability of Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Google Chrome FileSystem DoS

The vulnerability of Google Chrome’s FileSystem component is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

FreeRDP Buffer Overflow DoS

The vulnerability of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF, potentially...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-17566

A flaw was found in pgAdmin 4, a management tool for PostgreSQL databases. The Import/Export Data feature incorrectly processes certain user-provided SQL queries, specifically regarding how backslash characters are interpreted. This vulnerability allows an authenticated remote attacker, with...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...