🚨 CVE-2026-62886
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
🎖@cveNotify
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-69855
Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-77642
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.
🎖@cveNotify
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.
🎖@cveNotify
🚨 CVE-2026-84327
Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the comi...
🚨 CVE-2026-84330
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the comi...
🚨 CVE-2026-84333
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
🎖@cveNotify
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the comi...
🚨 CVE-2026-83959
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
🎖@cveNotify
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
🎖@cveNotify
Adobe
Adobe Security Bulletin
Security updates available for Adobe Substance 3D - Sampler | APSB26-121
🚨 CVE-2026-65818
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-70178
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-80098
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-18858
IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
🎖@cveNotify
IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH [CVE-2026-18858]
IBM i is vulnerable to obtaining sensitive information from a privileged file [CVE-2026-18858] in OpenSSH as described in the vulnerability details section.
🚨 CVE-2026-19299
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
🎖@cveNotify
Ibm
Security Bulletin: Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and…
Langflow contains multiple authenticated path-traversal vulnerabilities that allow an attacker to read arbitrary files accessible to the Langflow server process, bypassing the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true security control. The ChatInput component's…
🚨 CVE-2026-19304
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
🎖@cveNotify
Ibm
Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple…
Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The…
🚨 CVE-2026-19649
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.
🎖@cveNotify
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.
🎖@cveNotify
Ibm
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs.
🚨 CVE-2026-13297
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.
🎖@cveNotify
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.
🎖@cveNotify
🚨 CVE-2026-16689
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.
🎖@cveNotify
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.
🎖@cveNotify
Ibm
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs.
🚨 CVE-2026-17057
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Denial of Service Vulnerabilities in NFS [CVE-2026-17057, CVE-2026-17207]
IBM i is vulnerable to denial of service due to missing authentication and a buffer overflow [CVE-2026-17057, CVE-2026-17207] in Network File System (NFS) as described in the vulnerability details section.
🚨 CVE-2026-17274
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Debug Server
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-16826, CVE-2026-17499, CVE-2026-17273, CVE-2026-17259, CVE-2026-18076, CVE-2026-17274, CVE-2026-17270, CVE-2026-18073] in Debug Server as described in the vulnerability details section.
🚨 CVE-2026-17622
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge…
Langflow uses filesystem path construction as part of several components and API endpoints, including the Directory component, the Knowledge Base connector ingestion endpoint, and the Knowledge Base flow component. In the Directory component, user-supplied…
🚨 CVE-2026-17631
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
Langflow uses outbound HTTP request functionality as part of several flow components, including components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. These components accept user-supplied…
🚨 CVE-2026-18221
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [CVE-2026-18175…
IBM i is vulnerable to manipulation of database transactions due to improper authorization [CVE-2026-18175] and allowing unathorized access due to improper validation [CVE-2026-18221] in Distributed Data Management (DDM) / Distributed Relational Database…