CVE-2026-91728

CVE-2026-91728 is an integer overflow in V8 , the JavaScript engine used by Google Chrome prior to version 153.0.8010.47 . A remote attacker can exploit this flaw by enticing a user to visit a crafted HTML page , leading to arbitrary code execution inside the browser sandbox . The bug was reporte...

CVE-2026-91749

CVE-2026-91749 is a use-after-free in the Workers component of Google Chrome , rated Critical by Chromium with a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). A remote attacker could potentially execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML...

CVE-2026-91721

CVE-2026-91721 is a use after free vulnerability in the Internals component of Google Chrome , affecting versions prior to 153.0.8010.47 . A remote attacker can exploit it via a crafted HTML page to potentially execute arbitrary code outside the sandbox . The Chromium team rates it Critical ; CVS...

CVE-2026-91726

CVE-2026-91726 is an out-of-bounds read in WebGL affecting Google Chrome on Android prior to 153.0.8010.47 . A remote attacker can exploit a crafted HTML page to read memory outside the browser's sandbox , leading to information disclosure . Chromium rates it Critical ; the NVD CVSS 3.1 score is ...

CVE-2026-66372

CVE-2026-66372 affects the Digital Watchdog VMAX DVR and NVR product lineups. The root cause is a predictable seed in the pseudo-random number generator (PRNG) , resulting in insufficiently random values that make web session tokens predictable and bound their entropy to the seed space. The CVSS ...

CVE-2026-66887

Digital Watchdog VMAX DVR and NVR devices are vulnerable due to missing authorization on state-changing CGI endpoints and the absence of session checks , allowing an attacker on the adjacent network to modify device state without authentication. CISA ICS-CERT rated this CRITICAL (CVSS 3.1: 9.6 / ...

CVE-2026-79994

CVE-2026-79994 affects the guest-to-host Unix-domain socket (UDS) forwarder in Docker Sandboxes . The relay validates that a socket path resides inside an authorized workspace but later reconnects using the raw pathname. A malicious guest can exploit a symlink race by replacing an intermediate di...

CVE-2026-68950

CVE-2026-68950 affects Digital Watchdog VMAX DVR and NVR product lineups. The root cause is hard-coded credentials , which allow an attacker to run the ftpd service as root , granting remote root file access where FTP is reachable. The vulnerability is rated HIGH severity (CVSS 3.1: 8.8, CVSS 4.0...

CVE-2026-68070

Digital Watchdog VMAX DVR and NVR product lineups are affected by a missing authentication flaw for a critical function, allowing an adjacent-network attacker—requiring no privileges—to execute code as root by passing received bytes directly to a system command (command injection). CISA rates it ...

CVE-2026-54544

Fireshare , a self-hosted media and link sharing platform, contains an unauthenticated SSRF vulnerability prior to version 1.6.16 . Two API endpoints—POST /api/test-discord-webhook and POST /api/test-webhook—are missing the @login_required decorator, allowing an attacker to trigger arbitrary outb...

CVE-2026-66890

Digital Watchdog VMAX DVR and NVR devices are affected by a hard-coded credentials vulnerability that allows an attacker with adjacent-network access to gain remote file access with root privileges when the device's FTP service is reachable. The CISA-assigned CVSS 3.1 score is 9.6 (CRITICAL) , wi...

CVE-2026-54337

Fireshare is a self-hosted media and link sharing application. Prior to version 1.6.14 , an argument injection in the video upload function allows an unauthenticated remote attacker to write or overwrite system files, resulting in high impact on confidentiality, integrity, and availability (CVSS ...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored XSS vulnerability in SVG file handling, triggered only when the non-default "Reject files containing potentially harmful elements" sanitization mode was active. In this mode, uploaded SVGs were validated solely against a small built-in blocklist (the s...

CVE-2026-68953

CVE-2026-68953 is a missing authentication for critical function vulnerability affecting the Digital Watchdog VMAX DVR and NVR product lineups. Unauthenticated attackers on an adjacent network can send crafted HTTP(S) requests to bypass authentication and disclose sensitive device information, in...

CVE-2026-88065

tts-be is a backend service for a university timetable selector application. Versions prior to 2.1.0 contain a Broken Access Control vulnerability affecting multiple API endpoints, including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata. By chaining these unauthenticated end...

CVE-2026-18426

Concrete CMS versions 9.0.0 through 9.5.2 contained an authorization flaw in the Express Form block 's control-management actions. The actions relied solely on CSRF token validation rather than a block-level edit-permission check. Because the token is bound to the user and action—not to a specifi...

CVE-2026-92237

CVE-2026-92237 affects Devolutions PowerShell Universal 2026.2.5 and earlier . The slow query logging feature writes SQL parameter values to the system log on instances backed by Microsoft SQL Server , exposing sensitive data. An authenticated user with log read permission can obtain application ...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 are affected by a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . The panel's check endpoint returned the submitted page path unmodified in its JSON response, and client-side JavaScript inserted each v...

CVE-2026-81925

Concrete CMS before 9.5.3 is vulnerable to reflected cross-site scripting (XSS) caused by improper neutralization of a user-supplied custom date format when rendering conversation messages. An attacker could execute arbitrary JavaScript in a victim's browser by tricking them into submitting a cra...

CVE-2026-87289

CVE-2026-87289 affects the helidon-webserver-static-content component of Oracle Helidon (Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP can trigger a hang or frequently repeatable crash, resulting in a complete denial of service ...