CVE-2026-110156

An incorrect reference resolution flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561892119...

CVE-2026-110153

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742182...

CVE-2026-110152

A buffer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567736859...

CVE-2026-110150

A privilege elevation flaw was found in the Installer component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561334760...

CVE-2026-110149

An use after free flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568437149...

CVE-2026-110148

An use after free flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/570050934...

CVE-2026-110146

An information leak flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561039723...

CVE-2026-110145

An use after free flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562243925...

CVE-2026-110144

An incorrect authorization flaw was found in the Mojo component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565252396...

CVE-2026-110143

An use of uninitialized variable flaw was found in the ThirdParty lmzasdk component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/554531101...

CVE-2026-110141

An observable discrepancy flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568895734...

CVE-2026-110140

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562038980...

CVE-2026-110139

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568037533...

CVE-2026-110137

An use after free flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561997899...

CVE-2026-110136

An use after free flaw was found in the PDF component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568719364...

CVE-2026-107718

A flaw was found in AdonisJS HTTP Server. The route URL generation helper fails to properly encode parameter values when constructing redirect destinations. A remote attacker can exploit this flaw by supplying a crafted path parameter starting with a forward slash, generating a scheme-relative...

CVE-2026-92817

A flaw was found in Ignition. The Perspective module fails to properly validate session privileges when determining Designer-level access. An authenticated attacker with access to a Vision project can supply a valid session identifier to obtain elevated Designer privileges. This can be exploited ...

CVE-2026-110151

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/570638834...

CVE-2026-86063

A flaw was found in Claude Code. When installing a plugin pinned to a specific commit hash, the application does not verify that the checked-out version matches the expected Secure Hash Algorithm SHA identifier. A remote attacker controlling a repository can create a branch named after the review...

CVE-2026-100706

A flaw was found in Kyverno. An authenticated user with namespace-level permissions can achieve privilege escalation to cluster administrator by supplying encoded path traversal sequences within policy requests. This vulnerability allows an attacker to bypass namespace isolation controls and crea...

CVE-2026-102599

A flaw was found in engine.io. A remote attacker can cause a Denial of Service DoS by establishing a valid session and sending a transport upgrade request with a mismatched or omitted protocol revision parameter. This discrepancy causes the server to attach incompatible communication handlers,...

CVE-2026-93294

A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces APIs using the data source's configured cloud identity. This unintended...

CVE-2026-33374

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...

CVE-2026-110249

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread...

CVE-2026-109828

A flaw was found in libsndfile. A remote attacker could exploit this vulnerability by enticing a user or application to process a specially crafted WAV audio file, triggering the use of an uninitialized variable during subchunk parsing. This issue may allow an attacker to read uninitialized memor...

CVE-2026-110247

A flaw was found in Thunderbird. A remote attacker could exploit an integer overflow in the libmime library to achieve arbitrary code execution or cause a Denial of Service DoS. By sending a sufficiently large email message, an attacker causes buffer size arithmetic to overflow without proper...

CVE-2026-109740

A flaw was found in Firefox. Incorrect boundary condition handling in the Win32 widget component allows an attacker to escape the browser's restricted sandbox environment. An attacker who has compromised a sandboxed content process could exploit this vulnerability to achieve privilege escalation...

CVE-2026-15577

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

CVE-2026-95502

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

CVE-2026-107832

A flaw was found in fastify. The framework's route schema validation fails to properly normalize the casing of header names declared within nested property name schemas. A remote attacker can exploit this vulnerability by submitting requests with restricted headers, bypassing header allow-lists o...

CVE-2026-109964

A flaw was found in ImageMagick. A remote attacker can exploit this vulnerability to achieve arbitrary code execution or trigger an application crash, resulting in a denial of service DoS. By providing a specially crafted PICT image file with manipulated dimension values, an integer overflow occu...

CVE-2026-109956

A flaw was found in NLTK. A path traversal vulnerability in the WekaClassifier module allows an attacker to bypass directory containment restrictions by supplying unvalidated model paths. By controlling these path arguments, an attacker can write arbitrary files or probe existing files outside of...

CVE-2026-109955

A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...

CVE-2026-109156

A flaw was found in MLServer. A remote attacker could achieve arbitrary file write by supplying a specially crafted environment archive containing path traversal sequences. Because the environment extraction handler does not adequately validate destination paths before unpacking, archive files ca...

CVE-2026-107717

A flaw was found in banks. When generating chat messages for Large Language Models LLMs, the library attempts to parse every rendered template line as structured data without restricting message roles. A remote attacker can exploit this flaw by submitting crafted input that is interpreted as...

CVE-2026-102832

A flaw was found in JupyterLab. This vulnerability allows an untrusted document to gain trusted status without intended user authorization. When a trust confirmation prompt is displayed, switching the active document causes JupyterLab to grant trust to whichever document is currently focused rath...

CVE-2026-102342

A flaw was found in ammonia. This flaw allows stored Cross-Site Scripting XSS in applications configured to permit SVG animate or set elements. The sanitizer fails to properly neutralize animation attributes that target link destinations with JavaScript URIs. A remote attacker can exploit this...

CVE-2026-101899

A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing CIDR notation in proxy bypass lists as IP address ranges, treating them as plain text...

CVE-2026-71892

A flaw was found in Bouncy Castle. A remote attacker can bypass cryptographic key-size validation by sending a crafted Cryptographic Message Syntax CMS message that uses key derivation. Due to an incorrect algorithm identifier comparison in the recipient handling logic, key-size verification is...

CVE-2026-109729

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

CVE-2026-108976

A flaw was found in Emacs. Processing a specially crafted filename with TRAMP can cause an OS command execution because tramp-user-regexp has an incomplete list of disallowed inputs. This vulnerability exists due to an incomplete fix of CVE-2026-79992. Mitigation To mitigate this vulnerability, d...

CVE-2026-71888

A flaw was found in Bouncy Castle. In its Cryptographic Message Syntax CMS streaming parser, messages with mismatched attribute and algorithm fields are improperly handled, allowing attributes to be returned as valid even though they were not protected by the Message Authentication Code MAC. A...

CVE-2026-93186

A flaw was found in the Linux kernel's Compute Express Link CXL mailbox driver. A local attacker could exploit an unbounded memory allocation vulnerability in the CXLMEMSENDCOMMAND function. By providing a large output size, an attacker could trigger a huge memory allocation, potentially leading ...

CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

CVE-2026-93199

A flaw was found in the Linux kernel's I3C master driver. The i3cmastersearchi3cdevduplicate function, which is designed to identify duplicate I3C target devices, could incorrectly identify the I3C master controller itself as a duplicate. This occurs because the function matches the controller's...

CVE-2026-93202

A flaw was found in the i3c master driver of the Linux kernel. This vulnerability occurs due to recursive locking during device registration, where the system attempts to acquire the same lock multiple times. A local attacker could potentially trigger this condition, leading to a system deadlock...

CVE-2026-93197

A flaw was found in the Linux kernel's memory cgroup memcg functionality. When a memory cgroup is shut down, its memory usage accounting is incorrectly copied instead of being moved to its parent cgroup. This leaves behind phantom counters that cause the system to waste resources by repeatedly...

CVE-2026-93200

A flaw was found in the Linux kernel's i3c master driver. This use-after-free vulnerability occurs because sysfs attribute callbacks can attempt to access memory that has already been deallocated. An attacker could potentially exploit this to cause system instability or a denial of service...

CVE-2026-93198

A flaw was found in the Linux kernel's dm-pcache component. A local attacker could provide a specially crafted image with a malformed dirtytail chain. This could cause the writeback worker to enter an infinite loop, leading to a denial of service DoS condition on the system...