🚨 CVE-2026-106221
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming...
🚨 CVE-2026-106222
Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
🎖@cveNotify
Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming...
🚨 CVE-2026-106223
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming...
🚨 CVE-2026-106224
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming...
🚨 CVE-2026-106225
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming...
🚨 CVE-2026-93678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-93679
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97655
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97671
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97673
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97674
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97676
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97679
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-97680
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify…
🚨 CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
🎖@cveNotify
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
🎖@cveNotify
Octopus
Security Advisory 2026-12
2026-12 Incorrect permission validation (CVE-2026-102488).
🚨 CVE-2026-82627
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
🎖@cveNotify
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
🎖@cveNotify
🚨 CVE-2026-87682
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
🎖@cveNotify
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
🎖@cveNotify
🚨 CVE-2026-87683
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.
🎖@cveNotify
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.
🎖@cveNotify
🚨 CVE-2026-87726
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.
🎖@cveNotify
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.
🎖@cveNotify
NXP Community
NXPNfcRdLib vulnerability in module phalFelica - CVE-2026-87726
Overview A software vulnerability - CVE-2026-87726 - has been identified in the supporting software NXPNfcRdLib. An insufficient API bounds checking in NXP NXPNfcRdLib module phalFelica up to Firmware version 07.14.00_Pub may allow an attacker with privileges…
🚨 CVE-2026-105683
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
🎖@cveNotify
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
🎖@cveNotify
GitHub
Improved storage path validation (#27217) · TryGhost/Ghost@770d438
ref https://linear.app/ghost/issue/ONC-1595/
- shared path normalization across local storage reads and URL conversion so image path handling stays consistent
- shared path normalization across local storage reads and URL conversion so image path handling stays consistent