CVE-2026-106223

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501633302...

CVE-2026-106217

A missing authorization flaw was found in the Google Lens component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501770489...

CVE-2026-106198

A missing authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/510773353...

CVE-2026-106194

A missing authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498739277...

CVE-2026-106196

A missing authorization flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504215649...

CVE-2026-106189

A code injection flaw was found in the ReaderMode component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502034469...

CVE-2026-106188

A confused deputy flaw was found in the SignIn component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/515477538...

CVE-2026-106185

An improper input validation flaw was found in the Viz component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502462485...

CVE-2026-106182

An ui misrepresentation flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514078734...

CVE-2026-106315

An use after free flaw was found in the Modularization component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497652727...

CVE-2026-98241

A flaw was found in the Linux kernel's IPv6 IPsec XFRM networking framework. When handling TCP connection handshakes routed through an IPsec tunnel with a reduced Maximum Transmission Unit MTU, the kernel's local error-handling path incorrectly treats incomplete connection request sockets as full...

CVE-2026-98242

A flaw was found in the Linux kernel's DMA-BUF subsystem. An integer truncation occurs when processing peer-to-peer Direct Memory Access DMA transfers with memory-mapped input/output regions exceeding four gigabytes. A local user could exploit this flaw to cause memory corruption, potentially...

CVE-2026-98313

A flaw was found in the Linux kernel's Qualcomm MSM DisplayPort driver. When display link training fails to initialize the connection, the driver improperly attempts an idle teardown sequence on an unpowered controller. A local user could trigger this condition during display state transitions,...

CVE-2026-98314

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture subsystem. A race condition during audio timer registration allows a new timer to become accessible to other processes before its internal data is initialized. A local user can exploit this vulnerability by concurrently...

CVE-2026-98240

A flaw was found in the Linux kernel's IP tunnel subsystem. When processing network routes with encapsulation options, the subsystem references tunnel options before their length is initialized. A local user with network configuration privileges can exploit this flaw by adding routes with specifi...

CVE-2026-98312

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA 6fire USB audio driver. When processing incoming audio data, the driver improperly calculates buffer sizes based on device-reported packet lengths without sufficient bounds checking. An attacker capable of connecting a...

CVE-2026-107890

A flaw was found in CUPS. An attacker who can submit print jobs can exploit this issue by sending a crafted request containing repeated Internet Printing Protocol IPP group tags. This triggers a NULL pointer dereference during job processing, causing the print scheduler daemon cupsd to crash and...

CVE-2026-107886

A flaw was found in CUPS. An authenticated user authorized to manage printer classes can cause a Denial of Service DoS by triggering a double-free memory error during printer class management. By submitting a class modification request with invalid parameters followed by a class deletion request,...

CVE-2026-107885

A flaw was found in cups. An attacker with network access to the Internet Printing Protocol IPP service can cause a Denial of Service DoS by initiating a document submission request and keeping the connection open without completing it. The print scheduler globally pauses timeout processing for a...

CVE-2026-106555

A flaw was found in OpenSSH's SSH daemon sshd. When Generic Security Service Application Program Interface GSSAPI authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential...

CVE-2026-98237

A flaw was found in the Linux kernel's MHI Mobile Broadband Interface Model MBIM driver. This flaw allows a malicious or compromised modem to cause a Denial of Service DoS by sending network frames with cyclic Network Datagram Pointer NDP chains that do not advance. Processing these cyclic...

CVE-2026-98235

A flaw was found in the Linux kernel's network traffic control subsystem. When processing a batched request to delete traffic actions, a failure encountered on an action bound to a filter causes the cleanup process to terminate prematurely without releasing references on subsequent actions. A loc...

CVE-2026-98233

A flaw was found in the Linux kernel's packet socket implementation. An attacker could cause a Denial of Service DoS by transmitting network packets that fail virtual network header processing. When processing encounters an error, the kernel fails to clear the ownership status of the assigned...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108093

A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...

CVE-2026-107888

A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service DoS by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before...

CVE-2026-106324

An incorrect authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501171258...

CVE-2026-106420

An incorrect calculation flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/477327257...

CVE-2026-106286

A confused deputy flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497148613...

CVE-2026-106265

An ui misrepresentation flaw was found in the File component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/380789337...

CVE-2026-106238

A race condition flaw was found in the Fonts component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/492374387...

CVE-2026-106222

An incorrect authorization flaw was found in the Sync component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/496623893...

CVE-2026-106208

A missing authorization flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497062057...

CVE-2026-106181

An incorrect reference resolution flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497350668...

CVE-2026-98311

A flaw was found in the Linux kernel's virtwifi driver. A local user can exploit this vulnerability by attempting to create a virtual network interface with an invalid name while the underlying network device is dormant. Due to improper initialization handling, the system prematurely frees memory...

CVE-2026-98236

A flaw was found in the Linux kernel's MHI MBIM Modem Host Interface Mobile Broadband Interface Model driver. When receiving network data, the driver ignores the return value of memory copy operations when extracting datagrams. A compromised or malicious modem can supply crafted datagram offsets...

CVE-2026-83632

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS or memory corruption by sending specially crafted network requests to services utilizing the C++ HTTP transport layer. Due to improper input validation and resource handling, these requests trigger an integer...

CVE-2026-108039

A flaw was found in Apache CXF. By default, the XML parsing utility does not enforce limits on the total number of elements or characters within an incoming XML document. A remote attacker could exploit this vulnerability by sending an excessively large XML request, causing the application to...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

CVE-2026-107815

A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to...

CVE-2026-107814

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

CVE-2026-107716

A flaw was found in Banks. The directory prompt registry fails to properly validate symbolic links file system shortcuts that point to another location. An attacker with the ability to influence files in the prompt directory can exploit this vulnerability by creating links that point outside the...

CVE-2026-106421

An use after free flaw was found in the PDF component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567873463...

CVE-2026-107282

A flaw was found in AsyncHttpClient. When an application performs request retries or failovers to a different host, the client fails to properly reset the original host's security and proxy context. Consequently, an unintended destination host can receive sensitive information, including...

CVE-2026-106423

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/566347711...

CVE-2026-106383

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567447106...

CVE-2026-106379

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561987051...

CVE-2026-106357

An use after free flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567160162...

CVE-2026-106349

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567538973...

CVE-2026-106329

An incorrect authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562043997...