CVE-2026-34968 Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

EUVD-2026-65197

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34964 Adminer before 5.5.0 SSRF via PDO DSN Injection

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] without a trusted-proxy check or validation of the prefix value. An attacker can inject an absolute URL (e.g., https://evil.example) that propagates into Location redirect headers, the Set...

SUSE-SU-2026:3774-1 Security update for the Linux Kernel (Live Patch 14 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.52 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

EUVD-2026-65184

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

PT-2026-81481

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their...

Google Chrome < 152.0.7977.64 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 152.0.7977.64. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop0256176589 advisory. - Use after free in Aura in Google Chrome prior to 152.0.7977.65...

PT-2026-81729

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the Safebrowsing component allows a remote attacker to bypass system access restrictions by using a crafted file. Recommendations Update Google Chrome to...

PT-2026-81815

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in WebRTC allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. WebRTC Web Real-Time...

PT-2026-81587

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in ReaderMode allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can...

PT-2026-81694

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Dawn allows a remote attacker to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome t...

PT-2026-81701

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Chromecast allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HT...

PT-2026-81663

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper state validation in the Performance component allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-81712

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Improper input validation allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML...

PT-2026-81820

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Cookies allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin policy...

PT-2026-81598

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in DeviceBoundSessionCredentials allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social...

PT-2026-81752

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Variations allows a remote attacker to potentially bypass the web origin policy through crafted network traffic. The web origin policy is a security mechani...

PT-2026-81327

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description A Server-Side Request Forgery SSRF issue exists due to a Time-of-Check to Time-of-Use TOCTOU flaw and a fail-open DNS validation mechanism. The JobSubmitRequest.validate webhook url function...