CVE-2026-106392

An information leak flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514426571...

CVE-2026-106236

An ui misrepresentation flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556233068...

CVE-2026-103005

A flaw was found in Elasticsearch. An authenticated attacker with connector management privileges can create and access connector resources containing an excessively large description field, causing the cluster to allocate an uncontrolled amount of memory. This issue can exhaust available heap...

CVE-2026-106352

An incorrect authorization flaw was found in the WebProtect component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553139506...

CVE-2026-106302

An ui misrepresentation flaw was found in the PermissionElement component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514071472...

CVE-2026-103008

A flaw was found in Elasticsearch. An authenticated user with read access to an index can trigger unbounded recursion by submitting a request defining a scripted runtime field that generates deeply nested geometry structures. Because the server does not enforce a recursion depth limit when...

CVE-2026-103006

A flaw was found in Elasticsearch. An authenticated remote user with read access can trigger excessive recursion by submitting a specially crafted search request with deeply nested aggregations. Processing this request exhausts server resources and causes the affected node to crash, resulting in ...

CVE-2026-102411

A flaw was found in Elasticsearch. An authenticated user with index template management privileges can cause a Denial of Service DoS by registering multiple template resources and requesting them together. Although size limits exist for individual metadata entries, the system does not restrict...

CVE-2026-102404

A flaw was found in Elasticsearch. An authenticated remote attacker with low privileges can submit a specially crafted query to the query processing engine, triggering excessive memory allocation. This uncontrolled memory growth leads to an out-of-memory crash that terminates the service node,...

CVE-2026-106225

A missing authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501805355...

CVE-2026-102409

A flaw was found in Elasticsearch. An authenticated user with low privileges can cause a Denial of Service DoS by triggering excessive resource allocation through uncontrolled recursive operations. This issue causes the affected Elasticsearch node to terminate unexpectedly, disrupting service...

CVE-2026-102408

A flaw was found in Elasticsearch. An authenticated attacker with read access to an index can cause a Denial of Service DoS by submitting queries containing specially crafted regular expressions to the ES|QL CHUNK function. Because the component does not properly restrict regular expression...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

CVE-2026-106403

An incorrect authorization flaw was found in the Accessibility component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/523601696...

CVE-2026-106416

A code injection flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514072462...

CVE-2026-106361

An incorrect provision of specified functionality flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513781133...

CVE-2026-106331

An improper input validation flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553256068...

CVE-2026-106405

A race condition flaw was found in the CustomTabs component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517150523...

CVE-2026-106356

A clickjacking flaw was found in the EVP component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517090646...

CVE-2026-106391

An incorrect authorization flaw was found in the WebShare component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522325665...

CVE-2026-106354

An improper resource exposure flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511796554...

CVE-2026-106304

An out of bounds read flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553124799...

CVE-2026-106384

A missing authorization flaw was found in the SiteIsolation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/554348119...

CVE-2026-106301

A confused deputy flaw was found in the Contextual Tasks component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/523750306...

CVE-2026-106359

A confused deputy flaw was found in the DeviceBoundSessionCredentials component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/500532594...

CVE-2026-106326

A confused deputy flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511745101...

CVE-2026-106297

An incorrect authorization flaw was found in the Scheduling component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513735469...

CVE-2026-106290

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/507351786...

CVE-2026-106275

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514460295...

CVE-2026-106266

A confused deputy flaw was found in the Contextual Tasks component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501914204...

CVE-2026-106221

A confused deputy flaw was found in the WebAPKs component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/540049672...

CVE-2026-106250

A missing authorization flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502497790...

CVE-2026-80048

A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...

CVE-2026-106191

A missing authorization flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502282293...

CVE-2026-106382

An use after free flaw was found in the Chromecast component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/534994449...

CVE-2026-106443

A flaw was found in WeasyPrint. When processing documents with external image references, the image loading mechanism passes untrusted image data to the underlying image library without restricting unsafe formats such as Encapsulated PostScript EPS. A remote attacker could provide a crafted...

CVE-2026-103007

A flaw was found in Elasticsearch. An authorization flaw in delegated role-management permissions allows an authenticated user with delegated administrative access to escalate privileges. Because authorization checks fail to strictly enforce index scoping restrictions, a user with this privilege...

CVE-2026-103009

A flaw was found in Elasticsearch. When processing cross-cluster search requests under the Remote Cluster Security RCS model, the service validates permissions using one target identifier while retrieving data using a separate identifier. An authenticated attacker possessing a valid cross-cluster...

CVE-2026-43598

A flaw was found in the AMD ROCm Communication Collectives Library RCCL. Due to improper input validation, a network-adjacent attacker or a compromised peer node can supply a crafted memory address that the library accesses without proper verification. This vulnerability could allow an attacker t...

CVE-2026-106374

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552832446...

CVE-2026-106439

A flaw was found in hydra-core. Target execution policies used during object instantiation are stored in mutable module-level state. An attacker who supplies crafted configuration entries can manipulate this policy to remove restrictions on blocked targets. Successful exploitation allows the...

CVE-2026-106186

An uncontrolled search path element flaw was found in the CredentialProvider component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522557469...

CVE-2026-106318

An use after free flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/566111249...

CVE-2026-106235

An use after free flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565612897...

CVE-2026-105922

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service DoS by submitting a crafted inference request that combines prompt embeddings with sampling penalty parameters. When processed by the penalty handling mechanism, this request causes an unhandled failure that crashes the...

CVE-2026-53939

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...

CVE-2026-104045

A flaw was found in SSSD. A local user can trigger a Denial of Service DoS by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause...

CVE-2026-98170

A flaw was found in the Linux kernel's SMB client. When processing extended file attributes returned by a server, insufficient buffer validation allows the kernel to read data past the allocated boundaries. A malicious or compromised server could exploit this issue by returning a malformed...

CVE-2026-105800

A flaw was found in i18next-http-backend. A remote attacker can supply crafted language or namespace values to applications configured with custom translation path templates that begin directly with placeholders. This manipulation causes the application to generate unintended external web...

CVE-2026-104046

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...