CVE-2026-113039

An use after free flaw was found in the Bookmarks component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=566069559 https://code.google.com/p/chromium/issues/detail?id=113039...

CVE-2026-112915

A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the library attempts to open an SQLite database without properly restricting schema and query operations. A local attacker able to replace the lock database can provide a specially crafted file that causes lock acquisition ...

CVE-2026-113014

A flaw was found in chromium-browser. A use-after-free vulnerability exists in the PerformanceAPIs component, which occurs when memory is accessed after it has already been released. A remote attacker could exploit this flaw by enticing a user to view a specially crafted HTML page, potentially...

CVE-2026-113009

A flaw was found in Chromium's WindowControlsOverlay component. A remote attacker could trick a user into visiting a crafted HTML page to trigger a use-after-free memory condition. Successful exploitation allows the attacker to execute arbitrary code within the browser sandbox...

CVE-2026-113015

A flaw was found in chromium-browser. Due to improper memory handling a use-after-free condition within the Workers component, a remote attacker can execute arbitrary code inside the browser's sandbox environment. To exploit this vulnerability, the attacker must convince a user to load a speciall...

CVE-2026-113010

An out of bounds read flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518240362 https://code.google.com/p/chromium/issues/detail?id=113010...

CVE-2026-113095

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Focus component allows a remote attacker to execute arbitrary code within the browser's restricted environment sandbox. By convincing a user to visit a specially crafted HTML page, an attacker can trigger this memory...

CVE-2026-113282

A flaw was found in the Views component of Google Chrome. A remote attacker could exploit this vulnerability by convincing a user to visit a specially crafted HTML page, triggering a use-after-free memory condition where previously released memory is improperly accessed. Successful exploitation...

CVE-2026-113113

An use after free flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495899355 https://code.google.com/p/chromium/issues/detail?id=113113...

CVE-2026-113058

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution within the browser sandbox by tricking a user into visiting a specially crafted HTML page. This issue is caused by a use-after-free vulnerability in the WebUI Web User Interface component, where the...

CVE-2026-113092

A flaw was found in Google Chrome. A use-after-free vulnerability in the Passwords component allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a user to open a crafted HTML page. Because the application attempts to access memory after it has been released...

CVE-2026-106558

A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management SCM repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can...

CVE-2026-113329

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the installer component allows a remote attacker to read process memory inside the sandbox environment. By enticing a user to open a specially crafted HTML page, an attacker could exploit this flaw to disclose unauthoriz...

CVE-2026-113310

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Bluetooth component allows a remote attacker to read memory within the sandbox by enticing a user to view a crafted HTML page. This issue leads to unauthorized information disclosure from within the sandboxed...

CVE-2026-113050

An out of bounds read flaw was found in the HID component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=562655586 https://code.google.com/p/chromium/issues/detail?id=113050...

CVE-2026-113339

A flaw was found in chromium-browser. A remote attacker could achieve arbitrary code execution within the browser sandbox by convincing a user to open a specially crafted HTML page. This issue is caused by a use-after-free condition, where memory is improperly accessed after being released, durin...

CVE-2026-113314

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=562970433 https://code.google.com/p/chromium/issues/detail?id=113314...

CVE-2026-113311

A flaw was found in the chromium-browser ServiceWorker component. A remote attacker could exploit this flaw to execute arbitrary code within the browser sandbox by enticing a user to visit a specially crafted HTML page. This issue stems from a use-after-free memory corruption condition, which...

CVE-2026-113298

A flaw was found in the Transactions Platform component of Chromium. This vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox. By persuading a user to visit a specially crafted HTML page, an attacker can trigger a use-after-free error, which occurs when...

CVE-2026-113293

An use after free flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562040486...

CVE-2026-113287

A flaw was found in the Prompts component of chromium-browser. This use-after-free issue occurs when the application references memory after it has been released. A remote attacker could exploit this flaw by enticing a user to visit a specially crafted HTML page, potentially allowing arbitrary co...

CVE-2026-113261

A flaw was found in the WebAppInstalls component of the Chromium browser. This vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by convincing a user to view a specially crafted HTML page. The issue stems from a use-after-free condition, where...

CVE-2026-113256

A flaw was found in chromium-browser. A use-after-free vulnerability in the Permissions component allows a remote attacker to execute arbitrary code within the browser's sandbox. An attacker could exploit this flaw by enticing a user to visit a specially crafted HTML page...

CVE-2026-113203

A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the browser sandbox by convincing a user to visit a specially crafted HTML page. This vulnerability is caused by a use-after-free memory corruption issue in the Cascading Style Sheets CSS engine...

CVE-2026-113170

A flaw was found in the Chromium Autofill component. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free condition, where memory is improperly...

CVE-2026-113158

A flaw was found in chromium-browser. A use-after-free vulnerability in the Streaming component allows a remote attacker to achieve arbitrary code execution inside the sandbox. By convincing a user to open a specially crafted HTML page, an attacker can trigger memory corruption to compromise the...

CVE-2026-113111

A flaw was found in chromium-browser. A use-after-free memory vulnerability in the Compositing component allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. By enticing a user to view a malicious webpage, an attacker could exploit this condition ...

CVE-2026-113105

A flaw was found in chromium-browser. A remote attacker can exploit a use-after-free vulnerability—where memory is improperly accessed after being deallocated—in the Extensions component to achieve arbitrary code execution inside the browser sandbox. By convincing a user to visit a specially...

CVE-2026-113091

An use after free flaw was found in the PerformanceAPIs component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497433155 https://code.google.com/p/chromium/issues/detail?id=113091...

CVE-2026-113041

A flaw was found in the Actor component of Chromium. This vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox environment by tricking a user into visiting a crafted HTML page. The issue is caused by a use-after-free flaw, which occurs when the application...

CVE-2026-104626

A flaw was found in Gitea Actions. An authenticated user capable of submitting a pull request from a repository fork can exploit this vulnerability to execute untrusted workflow code on repository runners. When a workflow job awaiting approval is canceled by a subsequent run within the same...

CVE-2026-111758

A flaw was found in markdown-it. A remote attacker can cause a Denial of Service DoS by providing specially crafted Markdown input that contains an unclosed link reference definition spanning multiple lines. Processing this input triggers excessive CPU consumption due to inefficient string...

CVE-2026-113724

A flaw was found in virtualenv. When cleaning up files, the deletion error-handling routine follows symbolic links when attempting to restore write permissions for removal. A local attacker can exploit this issue by planting a symbolic link pointing to a file owned by the executing user, causing...

CVE-2026-113721

A flaw was found in virtualenv. A local attacker can exploit this issue by pre-creating symbolic or hard links in a destination directory before an environment is set up. Because virtualenv does not properly check or replace existing links when writing configuration and activation files, it can...

CVE-2026-113602

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute 0x1A character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept...

CVE-2026-113723

A flaw was found in virtualenv. This vulnerability allows arbitrary code execution if an attacker can influence the prompt text provided during environment creation. When a user subsequently activates the environment in a bash shell, the unvalidated prompt text is executed as shell syntax, allowi...

CVE-2026-113725

A flaw was found in virtualenv. The bash activation script improperly escapes the virtual environment name when configuring the command prompt. If a user activates a virtual environment created with a specially crafted name, an attacker can achieve arbitrary code execution in the user's shell...

CVE-2026-113722

A flaw was found in virtualenv. Due to improper quoting of interpreter paths when generating script wrappers, an attacker who influences the environment destination path can achieve arbitrary code execution. When a user subsequently executes a generated script launcher, embedded shell commands ar...

CVE-2026-112946

A flaw was found in Vite. On network-accessible development servers, improper path resolution during import analysis can cause root-relative paths to be incorrectly marked as safe module paths. An unauthenticated remote attacker can exploit this issue by requesting specially crafted paths that...

CVE-2026-113867

A flaw was found in Thunderbird. Due to improper escaping of attribute values when serializing outgoing Extensible Messaging and Presence Protocol XMPP messages, incoming request data is reflected in automatic responses without sanitization. A remote attacker can exploit this flaw by sending a...

CVE-2026-113868

A flaw was found in Thunderbird. When authenticating to an email server using NT LAN Manager NTLM or Generic Security Services Application Program Interface GSSAPI, the client fails to properly validate the server's authentication challenge format. A malicious server can exploit this flaw by...

CVE-2026-113720

A flaw was found in virtualenv. When creating new environments, cached package files retain their original permissions rather than respecting the current user file-creation mask umask. On shared systems where an environment directory is accessible to other users, a local attacker can modify these...

CVE-2026-113866

A flaw was found in Thunderbird. An information disclosure issue occurs during account setup when the Exchange AutoDiscover feature transmits requests over unencrypted Hypertext Transfer Protocol HTTP. A network attacker monitoring traffic can intercept these plaintext requests, exposing the user...

CVE-2026-113719

A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...

CVE-2026-113718

A flaw was found in virtualenv. This vulnerability could lead to arbitrary code execution when a user sources a generated xonsh activation script. Under certain multibyte character encodings, improper quoting of non-ASCII directory paths or prompt strings allows quote boundaries to be broken...

CVE-2026-113717

A flaw was found in virtualenv. When creating an environment using the pip seeder with the download option, the tool bypasses its package digest verification routines. A remote attacker controlling a package index could exploit this flaw to provide modified package files without triggering expect...

CVE-2026-113716

A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...

CVE-2026-113715

A flaw was found in virtualenv. When creating virtual environments, the tool fails to properly sanitize destination pathnames containing line-breaking characters before processing configuration files. An attacker who influences the target path can exploit this flaw to inject unauthorized settings...

CVE-2026-113714

A flaw was found in virtualenv. The utility writes downloaded software packages directly into its reusable cache before completing integrity verification checks. An attacker controlling a package repository can exploit this flaw to retain rejected or manipulated packages in the cache, resulting i...

CVE-2026-113713

A flaw was found in virtualenv. When configured to link application data through environment variables or configuration files, virtualenv can leave newly created environments linked to temporary package files that are deleted after setup completes. Because the virtual environment references an...