CVE-2026-113061

A flaw was found in the Chromoting component of chromium-browser. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted HTML page, leading to memory corruption. Successful exploitation could allow the attacker to execute arbitrary code within the...

CVE-2026-113064

A flaw was found in chromium-browser. A memory corruption vulnerability in the OptimizationGuide component allows a remote attacker to execute arbitrary code within the browser sandbox by convincing a user to open a crafted HTML page. Although execution is restricted to the sandbox environment,...

CVE-2026-113056

A flaw was found in the PerformanceAPIs component of chromium-browser. This memory corruption vulnerability allows a remote attacker to execute arbitrary code outside the browser sandbox by enticing a user to visit a crafted HTML page. Successful exploitation could allow the attacker to compromis...

CVE-2026-113063

A flaw was found in the Chromoting component of chromium-browser. Due to improper input validation, a remote attacker can achieve arbitrary code execution inside the browser sandbox by tricking a user into visiting a crafted HTML page. Successful exploitation allows unauthorized code to run withi...

CVE-2026-113062

A flaw was found in chromium-browser. Due to improper input validation in an application programming interface API, a remote attacker can potentially execute arbitrary code within the browser's sandbox environment by convincing a user to visit a specially crafted HTML page...

CVE-2026-113069

A flaw was found in chromium-browser's compositing component. A remote attacker could exploit this vulnerability by convincing a user to view a specially crafted HTML HyperText Markup Language page, triggering memory corruption. Successful exploitation allows the attacker to execute arbitrary cod...

CVE-2026-113060

A flaw was found in chromium-browser. Improper input validation in the Bluetooth component allows a remote attacker to potentially execute arbitrary code inside the browser's isolated sandbox environment by convincing a user to visit a crafted HTML page...

CVE-2026-113046

A flaw was found in the Passwords component of Chromium. Improper input validation allows a remote attacker to potentially execute arbitrary code inside the browser's sandbox environment by convincing a user to open a crafted HTML page...

CVE-2026-113049

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by convincing a user to visit a specially crafted HTML page, causing memory corruption. Successful exploitation may allow the attacker to execute arbitrary code within the browser's sandbox, an isolated...

CVE-2026-113052

A flaw was found in chromium-browser. A memory corruption issue exists within the V8 JavaScript engine. A remote attacker can exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution within the browser's isolated sandbox...

CVE-2026-113036

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code inside the application's restricted security environment sandbox. By convincing a user to visit a specially crafted HTML page, an attacker can trigger memory corruption within the browser's...

CVE-2026-113059

A flaw was found in the Sensor component of Chromium. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page, triggering memory corruption. Successful exploitation allows the attacker to execute arbitrary code inside the browser sandbox...

CVE-2026-113040

A flaw was found in the Proxy component of the Chromium browser. Due to improper input validation, a remote attacker could exploit this vulnerability by enticing a user to view a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the browser'...

CVE-2026-113022

A flaw was found in PDFium in chromium-browser. This memory corruption vulnerability allows a remote attacker to execute arbitrary code within the browser's restricted environment sandbox. An attacker can trigger this issue by convincing a user to open a specially crafted HTML page...

CVE-2026-113048

A flaw was found in the DevTools component of Chromium. This memory corruption vulnerability allows a remote attacker to execute arbitrary code inside the browser's sandbox environment by convincing a user to open a crafted HTML page...

CVE-2026-113031

A flaw was found in chromium-browser. A memory corruption issue in the Media component allows a remote attacker to execute arbitrary code within the application's restricted sandbox environment. To exploit this vulnerability, the attacker must convince a user to visit a specially crafted HTML pag...

CVE-2026-113023

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code outside the browser's isolated security environment sandbox by convincing a user to view a specially crafted HTML page. The issue stems from improper input validation within the Extensions...

CVE-2026-113018

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser's sandbox due to a memory corruption issue in the Input Method Editor IME, which manages text input. Exploitation requires tricking a user into viewing a specially crafted HTML page...

CVE-2026-113027

A flaw was found in the WebFonts component of chromium-browser. A remote attacker could exploit this vulnerability to execute arbitrary code within the browser's isolated sandbox environment by convincing a user to load a specially crafted HTML page. This issue is caused by memory corruption...

CVE-2026-113032

A flaw was found in the Omnibox address bar component of Google Chrome on Android. A remote attacker can exploit this memory corruption issue by convincing a user to open a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the browser's...

CVE-2026-113034

A flaw was found in the FileSystem component of chromium-browser. A remote attacker could exploit this memory corruption vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code within the application sandbox...

CVE-2026-113016

A flaw was found in chromium-browser. Improper input validation within the Extensions component allows a remote attacker to execute arbitrary code within the browser's restricted isolation environment sandbox. An attacker could exploit this vulnerability by enticing a user to view a specially...

CVE-2026-113020

A flaw was found in chromium-browser. Due to improper input validation in the Date component, a remote attacker can execute arbitrary code outside the browser's restricted sandbox environment by convincing a user to visit a specially crafted HTML page. Successful exploitation could compromise the...

CVE-2026-113013

A flaw was found in Chromium DevTools. A remote attacker could exploit this memory corruption issue by convincing a user to open a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the browser sandbox...

CVE-2026-112994

A flaw was found in chromium-browser. This vulnerability is caused by memory corruption within the browser. A remote attacker could exploit this issue by convincing a user to load a crafted HTML page, potentially leading to arbitrary code execution inside the browser sandbox...

CVE-2026-114459

A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-98647

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the kernel. When loading a specially crafted BPF program that accesses a structure with an empty flexible array member, the verifier...

CVE-2026-114458

A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses,...

CVE-2026-98646

A flaw was found in the Linux kernel's TCP subsystem. A local user running Berkeley Packet Filter BPF programs can cause a Denial of Service DoS by crashing the system. This issue occurs when destroying a listening TCP socket with pending connection requests, mistakenly invoking a sleeping...

CVE-2026-113029

An improper access control flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/523708661...

CVE-2026-113786

A flaw was found in pypdf. A remote attacker could trigger a Denial of Service DoS or unexpected behavior by enticing a user or service to process a specially crafted PDF document. When an image marked with a JPEG filter is loaded, pypdf fails to restrict decoding to the JPEG format before passin...

CVE-2026-98643

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This flaw can lead to information disclosure when a BPF socket operations program reads the round-trip time rttmin field during TCP connection handling. Because the kernel fails to verify the socket type before casting i...

CVE-2026-114129

A flaw was found in stream-json. The FlexAssembler component does not enforce a limit on nesting depth when processing JSON documents configured with path filters. By submitting a crafted document with deeply nested objects or arrays, an attacker can trigger excessive key operations that consume...

CVE-2026-114127

A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrary Cascading Style Sheets CSS rules into server-rendered we...

CVE-2026-114128

A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted input that prematurely closes the tag and injects malicious...

CVE-2026-113106

A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553126587...

CVE-2026-113340

A memory corruption flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/564213722...

CVE-2026-113157

An information leak flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/563352515...

CVE-2026-113143

A memory corruption flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/563352451...

CVE-2026-113002

A flaw was found in chromium-browser. A memory corruption vulnerability in the Transactions Platform allows a remote attacker to achieve information disclosure by convincing a user to open a crafted HTML page. This issue enables the attacker to read memory contents within the browser sandbox, an...

CVE-2026-98645

A flaw was found in the Linux kernel's Winwing Human Interface Device HID driver. The driver improperly manages memory when releasing force-feedback resources, leading to an invalid memory release and subsequent double free. A local user could trigger this flaw during device disconnection, driver...

CVE-2026-98644

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local user could cause a Denial of Service DoS by executing batch lookup or deletion operations on large hash maps. Due to a missing rescheduling check when traversing consecutive empty hash table entries, the kernel c...

CVE-2026-101516

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces APIs, or through sandboxed environments that execute untrusted Java code. Successful...

CVE-2026-83387

A flaw was found in the Java Database Connectivity JDBC component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces APIs or by executing untrusted code. If successfully exploited...

CVE-2026-114438

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. Thi...

CVE-2026-114110

A flaw was found in uv. This vulnerability allows an attacker to cause arbitrary file deletion by tricking a user into installing and subsequently uninstalling a specially crafted Python package. The issue occurs because uv fails to properly validate relative file paths listed in the package's...

CVE-2026-114105

A flaw was found in adm-zip. This vulnerability allows an attacker to achieve privilege escalation when an archive is extracted with the option to preserve original permissions enabled. By providing a specially crafted ZIP archive containing elevated permission attributes, unmasked execution flag...

CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...