PT-2026-66335

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66297

Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

PT-2026-66257

Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66063

Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66081

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66003

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

RHEL 9 : grafana-pcp (RHSA-2026:47721)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47721 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

PT-2026-66605

Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2 Description The String.prototype.match implementation fails to advance its native matching cursor in lib/match.cc when using a global RE2 pattern that can match an empty string. This behavior results in an infinite...

PT-2026-66408

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

PT-2026-66515

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description Lack of authentication allows the rendering of arbitrary Wiki Markup, which enables an attacker to retrieve sensitive data stored in JSPWiki variables. Recommendations Upgrade to version 2.12...

PT-2026-66504

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

Linux Distros Unpatched Vulnerability : CVE-2026-64685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for...

PT-2026-66592

Name of the Vulnerable Software and Affected Versions GoAccess versions prior to 1.11 Description The parse browser function incorrectly handles browser tokens starting with Opera. It moves a trailing version substring to a position that allows a crafted User-Agent in a processed access log to...

Linux Distros Unpatched Vulnerability : CVE-2026-17857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...

PT-2026-66548

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.2 Description The WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension a mechanism used to compress WebSocket messages to reduce bandwidth was not...

Linux Distros Unpatched Vulnerability : CVE-2026-17701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer...

Linux Distros Unpatched Vulnerability : CVE-2026-17834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce...

Linux Distros Unpatched Vulnerability : CVE-2026-17991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to...