CVE-2026-16517

The CVE-2026-16517 entry concerns libarchive’s ZIP writer. The issue is a signed integer overflow in archive_write_zip_header when ZIP encryption is enabled and the entry size is near INT64_MAX, causing the addition of encryption overhead to overflow int64_t. This leads to undefined behavior, pot...

CVE-2026-63259

CVE-2026-63259 affects Kibana and involves an Authorization Bypass via a user-controlled key, enabling potential information disclosure by referencing scheduled query result data in Kibana Spaces to which the requester lacks access. The CVSS 3.1 base score is 4.3 (Medium) with NETWORK attack vect...

CVE-2026-63145

Kibana Machine Learning (ML) functionality is affected by an Incorrect Authorization (CWE-863) vulnerability. A management endpoint performs only a coarse privilege check and does not verify that the requesting user has access to the specific ML job or notification resources referenced in the req...

CVE-2026-63144

Summary (CVE-2026-63144): An uncontrolled recursion (CWE-674) in Elasticsearch’s query evaluation can cause a denial of service. A low-privilege authenticated user with read-level index access can submit a crafted search request that triggers unbounded recursive processing, leading to a fatal err...

CVE-2026-56820

Netty’s OcspClient vulnerability (CVE-2026-56820) allows a replay attack by not validating the CertificateID in OCSP responses. A forged or unrelated-but-signed OCSP response can be accepted for another certificate issued by the same CA, bypassing revocation checks. Affected versions: 4.2.0.Final...

CVE-2026-56819

What was affected: Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final. Root cause: when processing HTTP/2 DATA frames for streams whose decompressor had already closed, Http2Decompressor.decompress(...) retains the inbound ByteBuf and does not release it on the error path, leak...

CVE-2026-63143

Technical details (affected products, components, versions, exploitability) are not publicly available in the provided documents; monitor for updates.

CVE-2026-56817

Netty CVE-2026-56817 affects Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final, where any caller delivering bytes to a channel pipeline containing XmlDecoder can send XML with a DOCTYPE to an AsyncXMLInputFactory started without security configuration, leaving DTD/entity handl...

CVE-2026-63142

CVE-2026-63142 affects Kibana's Reporting feature. An incomplete list of disallowed inputs (CWE-184) can allow an authenticated user to bypass outbound request restrictions configured by an admin, causing the reporting service to issue requests to network destinations that should be denied. The C...

CVE-2026-16424

CVE-2026-16424 is a use-after-free vulnerability in the GPU component of Google Chrome on Android prior to version 150.0.7871.182. The description states a remote attacker who has compromised the renderer process could potentially cause a sandbox escape via a crafted HTML page. Connected sources ...

CVE-2026-16423

Google Chrome UI use-after-free (CVE-2026-16423) affects Chrome versions prior to 150.0.7871.182. Root cause: use-after-free in the UI code, enabling a remote attacker to craft an HTML page and, via user-initiated UI gestures, potentially heap-corrupt and execute arbitrary code. Impact is high (r...

CVE-2026-16419

CVE-2026-16419 : Out-of-bounds read/write in ANGLE affects Google Chrome on Android (pre-150.0.7871.182). The issue could enable a remote attacker to escape the Chrome sandbox via a crafted HTML page. Connected sources confirm Chromium/Chrome involvement and specify ANGLE as the vulnerable compon...

CVE-2026-16422

Google Chrome on Linux is affected by CVE-2026-16422 due to insufficient validation of untrusted input in the Certificate component. Prior to version 150.0.7871.182, this could allow an attacker with a privileged network position to perform domain spoofing via malicious network traffic. The issue...

CVE-2026-16418

CVE-2026-16418 describes a stack buffer overflow in the V8 engine of Google Chrome (Chromium) before version 150.0.7871.182, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product is Google Chrome (Chromium-based) on desktop Windows; expl...

CVE-2026-16416

CVE-2026-16416 : Integer overflow in Chromecast within Chromium (Google Chrome/Chromium) potentially allows a local attacker to escape the sandbox via crafted network traffic. Affected versions include Chrome/Chromium prior to 150.0.7871.182; fixed in Chromium updates across distributions (e.g., ...

CVE-2026-16417

CVE-2026-16417 affects Google Chrome with uninitialized use in Skia . A remote attacker who compromised the renderer could leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 150.0.7871.182 . The incident is documented by multiple sources (NVD, EUVD, MSRC, Debian...

CVE-2026-16415

CVE-2026-16415 is a Chromium/Google Chrome vulnerability: insufficient validation of untrusted input in Extensions allows a crafted HTML page to spoof the Omnibox. Affects Google Chrome/Chromium before 150.0.7871.182 (Windows/Linux/others); Edge (Chromium-based) addresses via Chromium fix. Debian...

CVE-2026-16414

CVE-2026-16414 affects Chromium-based Chrome/Chromium with insufficient validation of untrusted input in Chromecast, enabling potential sandbox escapes via crafted network traffic. Affected versions are prior to 150.0.7871.182 (Chromium security note: High). Public advisories and distro trackers ...

CVE-2026-16413

CVE-2026-16413 is an out-of-bounds write in ANGLE used by Google Chrome (Chromium-based) prior to 150.0.7871.182, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. Connected sources confirm the issue in ANGLE and identify affected Chrome/Chromiu...

CVE-2026-16421

CVE-2026-16421 relates to an Inappropriate implementation in WebAudio in Google Chrome (Chromium) before 150.0.7871.182 that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability is part of a set of Chromium/WebAudio issues associated ...