ROS-20260911-73-0127

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0124

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0237

The vulnerability in Chromium is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260911-73-0231

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-90270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Multipath TCP MPTCP implementation where the mptcp token join cookie init state function fails to restore the local id when rebuilding a request socket for an MP...

CVE-2026-87987: External Control of System or Configuration Setting

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-79742

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-79742

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-45770

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

EUVD-2026-75797

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

CVE-2026-45770

Suricata versions 8.0.0 through 8.0.5 (exclusive) are affected by a Lua sandbox bypass. A Lua rule that registers an excessive number of flow variables can corrupt Lua detection state , potentially escaping Suricata's restricted Lua sandbox. The attack requires a crafted Lua script/rule to be loa...

CVE-2026-45770 Suricata lua: excessive flow variable registration can bypass sandbox

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua...

CVE-2026-79742 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-79742

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an incomplete environment variable blocklist in the MCP stdio server configuration. The specific root cause is that the OPENSSL_CONF environment variable is absent from the blocklist, permitting native code execution via OpenSSL engin...

CVE-2026-79742 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

SummaryRepo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from UR...

CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745

The Gemini CLI (prior to version 0.39.1 ) and the associated GitHub Action are vulnerable to arbitrary code execution . An unprivileged attacker can achieve this by tricking a victim into starting the CLI within an untrusted directory containing malicious .env files. These files can override GEMI...

PT-2026-89619

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A remote authenticated attacker can execute arbitrary code because of an incomplete environment variable blocklist. A blocklist is a security mechanism that prevents the use of specifi...

ROS-20260910-73-0093

The vulnerability of the WebNN component in Google Chrome and Microsoft Edge is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...