CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

PT-2026-85284

Name of the Vulnerable Software and Affected Versions MOOS-IvP uFldNodeBroker versions prior to 24.8.2 Description The uFldNodeBroker fails to validate the source of TRY SHORE HOST messages on the vehicle bus. This allows any publisher to enroll shore routes controlled by an attacker, enabling th...

PT-2026-85232

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description Incomplete cleanup within the Network component allows a remote attacker to bypass system access restrictions by sending specially crafted network traffic. Recommendations Update Google...

Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-143)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-143 advisory. - Missing Authorization CWE-862 in the...

CVE-2026-20354

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

SUSE CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

EUVD-2026-69732

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

EUVD-2026-69733

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84324

A use-after-free vulnerability in the Proxy component of Google Chrome (versions prior to 152.0.7977.75 ) allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium rates it High severity; NVD assigns a CVSS 3.1 score of 9.0 (CRITICAL) with a Chan...

CVE-2026-84324

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

SUSE CVE-2026-72297

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

CVE-2026-80637

A flaw was found in the Linux kernel's netfilter synproxy component. This vulnerability is due to unaligned memory access when adjusting timestamp fields. An attacker could potentially trigger this flaw by sending specially crafted network traffic, leading to performance degradation or a system...

PT-2026-84545

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in the Proxy component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

tcpreplay v4.6.1

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...

CVE-2026-51706

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling , resulting in a low a...