CVE-2026-79090

Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79191

Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78966

Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78942

Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-79001

Information leak in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79782 rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom,...

CVE-2026-16434

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

EUVD-2026-65160

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

CVE-2026-75421

CVE-2026-75421 is a stack-buffer-underflow in the IOFile::getLine() function of aria2 versions up to and including 1.37.0 . The flaw is triggered locally without privileges or user interaction, leading to a low availability impact (potential crash) with no confidentiality or integrity impact (CVS...

UBUNTU-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2025-36940

Use-After-Free vulnerability in a zircon kernel pager proxy Fuchsia, which could lead to a Privilege Escalation from Userspace to Kernel AP...

EUVD-2025-210765

Use-After-Free vulnerability in a zircon kernel pager proxy Fuchsia, which could lead to a Privilege Escalation from Userspace to Kernel AP...

CVE-2025-36940

CVE-2025-36940 is a Use-After-Free vulnerability in the zircon kernel pager proxy of the Fuchsia operating system. An attacker can exploit this flaw to achieve Privilege Escalation from Userspace to Kernel (AP) . The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low comp...

CVE-2026-28153

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

CVE-2026-28165

Unauthenticated Privilege Escalation in the WordPress Digits plugin (versions <= 9.2), discovered by VanTastic via Patchstack. The flaw requires no authentication or user interaction, is network-exploitable with low complexity, and carries a CVSS 9.8 (CRITICAL) score with high impact on confid...

EUVD-2026-64789

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri is susceptible to a potential Denial-of-Service DoS attack due to certain inputs containing a very large number of Unicode characters...

Astra Linux – Vulnerability in curl

There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...