๐จ CVE-2026-17713
Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
๐@cveNotify
Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
๐@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux, which will roll out over the c...
๐จ CVE-2026-27765
Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
๐@cveNotify
Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
๐@cveNotify
Intel
INTEL-SA-01487
๐จ CVE-2026-58094
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.
An unprivileged local user can exploit this race to escalate privileges.
๐@cveNotify
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.
An unprivileged local user can exploit this race to escalate privileges.
๐@cveNotify
๐จ CVE-2026-69284
Heap-based buffer overflow in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Heap-based buffer overflow in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-69296
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.
๐@cveNotify
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.
๐@cveNotify
๐จ CVE-2026-69299
Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-80097
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
๐@cveNotify
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
๐@cveNotify
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
๐@cveNotify
GitLab
GitLab.org / GitLab ยท GitLab
GitLab is the open-source DevSecOps platform that provides a complete software development lifecycle toolchain including source control, CI/CD, security scanning, and project management in a single application.
๐จ CVE-2026-94030
A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.
๐@cveNotify
A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.
๐@cveNotify
GitHub
LibGfx: Reject BMPs with an unrepresentable height ยท SerenityOS/serenity@007041b
A signed DIB height may be negative for top-down images, but the
minimum signed value cannot be negated. Reject it while parsing so
size and frame decoding cannot overflow.
minimum signed value cannot be negated. Reject it while parsing so
size and frame decoding cannot overflow.
๐จ CVE-2026-94035
A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
๐@cveNotify
A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
๐@cveNotify
GitHub
Drug_recommendation_system/xss/profile/Readme.md at main ยท KaranParelkar/Drug_recommendation_system
Vulnerabilities found in drug recommendation system - KaranParelkar/Drug_recommendation_system
๐จ CVE-2026-94040
A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
GitHub
GitHub - vas3k/TaxHacker: Self-hosted AI accounting app. LLM analyzer for receipts, invoices, transactions with custom promptsโฆ
Self-hosted AI accounting app. LLM analyzer for receipts, invoices, transactions with custom prompts and categories - vas3k/TaxHacker
๐จ CVE-2026-94045
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
GitHub
GitHub - newbee-ltd/newbee-mall: ๐ฅ ๐newbee-mallๆฏไธๅฅ็ตๅ็ณป็ป๏ผๅ
ๆฌๅบ็ก็ๆฌ(Spring Boot+Thymeleaf)ใๅๅ็ซฏๅ็ฆป็ๆฌ(Spring Boot+Vue 3+Element-Plus+Vueโฆ
๐ฅ ๐newbee-mallๆฏไธๅฅ็ตๅ็ณป็ป๏ผๅ
ๆฌๅบ็ก็ๆฌ(Spring Boot+Thymeleaf)ใๅๅ็ซฏๅ็ฆป็ๆฌ(Spring Boot+Vue 3+Element-Plus+Vue-Router 4+Pinia+Vant 4) ใ็งๆ็ๆฌใGo่ฏญ่จ็ๆฌใๅพฎๆๅก็ๆฌ(Spring Cloud Alibaba+Nacos+Sentinel+Seata+Spring Cloud Gatew...
๐จ CVE-2026-94050
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
๐@cveNotify
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
๐@cveNotify
๐จ CVE-2026-94092
A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
๐@cveNotify
GitHub
GitHub - dmlc/dgl: Python package built to ease deep learning on graph, on top of existing DL frameworks.
Python package built to ease deep learning on graph, on top of existing DL frameworks. - dmlc/dgl
๐จ CVE-2026-94097
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
๐@cveNotify
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
๐@cveNotify
FirmHarnessโs Space on Notion
Netcore NBR200V2 Vul - 5 | Notion
Basic Information
๐จ CVE-2026-36469
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
๐@cveNotify
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
๐@cveNotify
GitHub
GitHub - CuteNews/cutenews-2.0: Cutenews 2.0 Repositary
Cutenews 2.0 Repositary. Contribute to CuteNews/cutenews-2.0 development by creating an account on GitHub.
๐จ CVE-2026-79320
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.
๐@cveNotify
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.
๐@cveNotify
GitHub
TraceLoom/CVEs/CVE-2026-79320.md at main ยท lichoin/TraceLoom
Contribute to lichoin/TraceLoom development by creating an account on GitHub.
๐จ CVE-2026-67827
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.
๐@cveNotify
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.
๐@cveNotify
GitHub
OS Command Injection in setServerConfig via unvalidated ffmpeg.snap template
### Summary
ZLMediaKit's setServerConfig API accepts arbitrary values for the "ffmpeg.snap" configuration key without any validation or sanitisation. An attacker who knows the API ...
ZLMediaKit's setServerConfig API accepts arbitrary values for the "ffmpeg.snap" configuration key without any validation or sanitisation. An attacker who knows the API ...
๐จ CVE-2026-88405
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.
๐@cveNotify
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.
๐@cveNotify
GitHub
Arbitrary Code Execution via new Function() in Remote Function Registration Service (CWE-94) ยท Issue #9 ยท czx1111/cve
Summary RemoteRegisterFunctionService in packages/sheets-formula/src/services/remote/remote-register-function.service.ts receives serialized function strings via RPC channel and uses new Function(\...
๐จ CVE-2026-88410
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
๐@cveNotify
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
๐@cveNotify
GitHub
UDF hardening: graph.UDF missing write flag, fail-open ASSERT on RDB load, no JS interrupt handler ยท Issue #2401 ยท FalkorDB/FalkorDB
Reported to security@falkordb.com by firewok137 / "JerryGW", who reports it against v4.20.1. Filing publicly with substantially revised framing. Maintainer note on the reported framing. T...
๐จ CVE-2026-92529
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.
๐@cveNotify
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.
๐@cveNotify
GitLab Docs
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 | GitLab Docs
Learn more about GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).