https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg reports:

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.

Gitlab reports:

Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE

Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EE

Cache Poisoning issue in OAuth/OIDC discovery endpoints impacts GitLab CE/EE

Improper Access Control issue in GraphQL work item email address field impacts GitLab CE/EE

Incomplete enforcement of instance-wide SAML/LDAP membership lock allows unauthorized member additions in GitLab EE

Internal Credential Exposure issue in internal response headers impacts GitLab CE/EE

Authorization Bypass Through User-Controlled Key issue in group milestones API impacts GitLab CE/EE

Use of Less Trusted Source issue in AI Gateway feature enablement header impacts GitLab EE

Use of Cache Containing Sensitive Information issue in merge request title rendering impacts GitLab CE/EE

Improper Access Control issue in merge request approval policy enforcement impacts GitLab EE

Improper Cleanup on Thrown Exception issue in security findings impacts GitLab EE

Improper Access Control issue in group Duo admin-lock enforcement for Amazon Q settings impacts GitLab EE

Mailpit author reports:

The thumbnail endpoint GET /api/v1/message/{ID}/part/{PartID}/thumb parses EXIF metadata of image attachments with github.com/rwcarlsen/goexif to apply orientation. goexif's TIFF IFD walker only detects a self-referencing IFD (next == prev). An attachment whose IFD chain forms a cycle of length 2 (IFD0 → IFD1 → IFD0) sends the request handler into an infinite loop that appends a new *tiff.Dir on every iteration. The goroutine never terminates, pins one CPU core permanently, and its live heap grows without bound. A 651-byte JPEG is sufficient.

The Keycloak Team reports:

• [CVE-2026-15943]: OIDC identity provider update reuses masked client secret after token URL changes.
• [CVE-2026-18569]: OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled.
• [CVE-2026-82968]: Persistent wrong-account linking through null / GitHub identity provider.
• [CVE-2026-94001]: Admin credential DELETE bypasses denied reset-password permission.
• [CVE-2026-94000]: A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role.
• [CVE-2026-94218]: 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254
• [CVE-2026-94215]: Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession.
• [CVE-2026-94213]: Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978.
• [CVE-2026-94217]: UMA scope merge across resource owners via name collision in resolveResourcePermission.
• [CVE-2026-96446]: Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none.
• [CVE-2026-96445]: Conditional OTP trusts skip headers on untrusted proxy paths.
• [CVE-2026-97177]: Generic user update bypasses denied reset-password permission.
• [CVE-2026-95503]: Potential KDC spoofing attack when Kerberos password authentication is enabled.
• [CVE-2026-97311]: Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening).
• [CVE-2026-97846]: Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied.
• [CVE-2026-101333]: Unbounded metric series creation via idp tag on broker login endpoint.
• [CVE-2026-91777]: Third-party dependency fix, com.fasterxml.jackson.core:jackson-databind
• Multiple CVEs in third-party dependency tools.jackson.core:jackson-databind
• [CVE-2026-103884]: Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf
• Multiple CVEs in third-party dependency simple-git.
• Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read.
• [CVE-2026-107121]: SMTP starttls=true permits plaintext credential and message downgrade.

Chrome Releases reports:

This update includes 353 security fixes:

• Critical CVE-2026-113341: Memory corruption in Skia.
• Critical CVE-2026-113279: Memory corruption in Accessibility.
• Critical CVE-2026-113072: Memory corruption in CSS.
• Critical CVE-2026-113280: Memory corruption in Paint.
• Critical CVE-2026-113271: Use after free in Accessibility.
• Critical CVE-2026-113303: Memory corruption in WebRTC.
• High CVE-2026-113101: Use after free in SiteIsolation.
• High CVE-2026-113097: Use after free in FileSystem.
• High CVE-2026-113098: Memory corruption in CacheStorage.
• High CVE-2026-113242: Memory corruption in ANGLE.
• High CVE-2026-113058: Use after free in WebUI.
• High CVE-2026-113082: Memory corruption in ANGLE.
• High CVE-2026-113119: Use after free in Network.
• High CVE-2026-113092: Use after free in Passwords.
• High CVE-2026-113134: Memory corruption in ANGLE.
• High CVE-2026-113339: Use after free in SVG.
• High CVE-2026-113317: Memory corruption in Accessibility.
• High CVE-2026-113193: Memory corruption in V8.
• High CVE-2026-113117: Improper input validation in ANGLE.
• High CVE-2026-113188: Memory corruption in GPU.
• High CVE-2026-113104: Memory corruption in Frames.
• High CVE-2026-113322: Memory corruption in Dawn.
• High CVE-2026-113163: Use after free in WebGL.
• High CVE-2026-113253: Use after free in Canvas.
• High CVE-2026-113298: Use after free in Transactions Platform.
• High CVE-2026-113315: Memory corruption in ANGLE.
• High CVE-2026-113236: Use after free in Navigation.
• High CVE-2026-113284: Memory corruption in XML.
• High CVE-2026-113141: Use after free in Transactions Platform.
• High CVE-2026-113316: Improper input validation in Views.
• High CVE-2026-113234: Memory corruption in ANGLE.
• High CVE-2026-113252: Improper input validation in ANGLE.
• High CVE-2026-113305: Use after free in Privacy.
• High CVE-2026-113044: Use after free in V8.
• High CVE-2026-113135: Memory corruption in PictureInPicture.
• High CVE-2026-113266: Memory corruption in ANGLE.
• High CVE-2026-113273: Memory corruption in ANGLE.
• High CVE-2026-113293: Use after free in ANGLE.
• High CVE-2026-113225: Memory corruption in Browser.
• High CVE-2026-113210: Use after free in ANGLE.
• High CVE-2026-113285: Memory corruption in ANGLE.
• High CVE-2026-113324: Use after free in GPU.
• High CVE-2026-113334: Improper input validation in ANGLE.
• High CVE-2026-113020: Improper input validation in Date.
• High CVE-2026-113222: Use after free in V8.
• High CVE-2026-113318: Memory corruption in ServiceWorker.
• High CVE-2026-113310: Out of bounds read in Bluetooth.
• High CVE-2026-113338: Use after free in Turbolev.
• High CVE-2026-113093: Memory corruption in DisplayLocking.
• High CVE-2026-113012: Improper input validation in GPU.
• High CVE-2026-113175: Improper input validation in FileSystem.
• High CVE-2026-113192: Memory corruption in V8.
• High CVE-2026-113309: Out of bounds read in Media.
• High CVE-2026-113295: Out of bounds read in ANGLE.
• High CVE-2026-113217: Use after free in WebAppInstalls.
• High CVE-2026-113040: Improper input validation in Proxy.
• High CVE-2026-113161: Use after free in WebRTC.
• High CVE-2026-113154: Memory corruption in Canvas.
• High CVE-2026-113336: Memory corruption in Compositing.
• High CVE-2026-113181: Use after free in Navigation.
• High CVE-2026-113019: Use after free in Turbolev.
• High CVE-2026-113095: Out of bounds read in Focus.
• High CVE-2026-113160: Use after free in Turbolev.
• High CVE-2026-113212: Memory corruption in PDF.
• High CVE-2026-113000: Memory corruption in Paint.
• High CVE-2026-113179: Use after free in Paint.
• High CVE-2026-112993: Use after free in Input.
• Medium CVE-2026-113055: Type confusion in FullScreen.
• Medium CVE-2026-113068: Use after free in Input.
• Medium CVE-2026-113320: Memory corruption in Navigation.
• Medium CVE-2026-113231: Improper input validation in Extensions.
• Medium CVE-2026-113174: Use after free in Extensions.
• Medium CVE-2026-113022: Memory corruption in PDFium.
• Medium CVE-2026-113079: Use after free in SiteIsolation.
• Medium CVE-2026-113191: Use after free in Internals.
• Medium CVE-2026-113250: Use after free in ANGLE.
• Medium CVE-2026-113109: Memory corruption in API.
• Medium CVE-2026-113113: Use after free in Extensions.
• Medium CVE-2026-113069: Memory corruption in Compositing.
• Medium CVE-2026-113006: Out of bounds read in Navigation.
• Medium CVE-2026-113263: Use after free in Core.
• Medium CVE-2026-113018: Memory corruption in IME.
• Medium CVE-2026-113301: Memory corruption in WebAppInstalls.
• Medium CVE-2026-113034: Memory corruption in FileSystem.
• Medium CVE-2026-113094: Memory corruption in API.
• Medium CVE-2026-113240: Use after free in Chromecast.
• Medium CVE-2026-113102: Out of bounds read in FileSystem.
• Medium CVE-2026-113142: Memory corruption in Extensions.
• Medium CVE-2026-113281: Memory corruption in SiteIsolation.
• Medium CVE-2026-113035: Out of bounds read in API.
• Medium CVE-2026-113211: Memory corruption in ServiceWorker.
• Medium CVE-2026-113011: Use after free in CredentialProvider.
• Medium CVE-2026-113198: Use after free in Extensions.
• Medium CVE-2026-113257: Memory corruption in Media.
• Medium CVE-2026-113070: Out of bounds read in GetUserMedia.
• Medium CVE-2026-113176: Memory corruption in Omnibox.
• Medium CVE-2026-113150: Memory corruption in Bindings.
• Medium CVE-2026-113311: Use after free in ServiceWorker.
• Medium CVE-2026-113078: Improper input validation in Compositing.
• Medium CVE-2026-113033: Use after free in Streaming.
• Medium CVE-2026-113026: Memory corruption in PDF.
• Medium CVE-2026-113302: Use after free in Extensions.
• Medium CVE-2026-113164: Memory corruption in Voice.
• Medium CVE-2026-113239: Range error in SiteIsolation.
• Medium CVE-2026-113131: Memory corruption in Bluetooth.
• Medium CVE-2026-113333: Memory corruption in Extensions.
• Medium CVE-2026-113147: Improper input validation in WebShare.
• Medium CVE-2026-113337: Memory corruption in Scroll.
• Medium CVE-2026-113127: Memory corruption in Browser.
• Medium CVE-2026-113129: Improper access control in Extensions.
• Medium CVE-2026-113264: Improper input validation in Extensions.
• Medium CVE-2026-113105: Use after free in Extensions.
• Medium CVE-2026-113220: Memory corruption in Extensions.
• Medium CVE-2026-113275: Use after free in API.
• Medium CVE-2026-113283: Memory corruption in CredentialProvider.
• Medium CVE-2026-113014: Use after free in PerformanceAPIs.
• Medium CVE-2026-113108: Use after free in Script.
• Medium CVE-2026-113343: Memory corruption in Sandbox.
• Medium CVE-2026-113319: Use after free in Accessibility.
• Medium CVE-2026-113057: Improper access control in ComputePressure.
• Medium CVE-2026-113219: Memory corruption in Contacts.
• Medium CVE-2026-113005: Memory corruption in Bluetooth.
• Medium CVE-2026-113209: Memory corruption in Navigation.
• Medium CVE-2026-113166: Memory corruption in History.
• Medium CVE-2026-113051: Memory corruption in CSS.
• Medium CVE-2026-113196: Improper access control in Mobile.
• Medium CVE-2026-113003: Memory corruption in HID.
• Medium CVE-2026-113155: Use after free in Glic.
• Medium CVE-2026-113290: Use after free in Input.
• Medium CVE-2026-113183: Memory corruption in FedCM.
• Medium CVE-2026-113289: Improper input validation in PerformanceAPIs.
• Medium CVE-2026-113146: Memory corruption in PerformanceAPIs.
• Medium CVE-2026-113207: Use after free in SiteIsolation.
• Medium CVE-2026-113205: Use after free in Variations.
• Medium CVE-2026-113162: Improper input validation in Actor.
• Medium CVE-2026-113118: Memory corruption in Extensions.
• Medium CVE-2026-113232: Memory corruption in Search.
• Medium CVE-2026-113327: Use after free in Chromecast.
• Medium CVE-2026-112999: Use after free in API.
• Medium CVE-2026-113249: Improper input validation in Mobile.
• Medium CVE-2026-113272: Memory corruption in Extensions.
• Medium CVE-2026-113112: Use after free in Extensions.
• Medium CVE-2026-113321: Use after free in Extensions.
• Medium CVE-2026-113059: Memory corruption in Sensor.
• Medium CVE-2026-113137: Memory corruption in Extensions.
• Medium CVE-2026-113208: Use after free in ContextualSearch.
• Medium CVE-2026-113238: Memory corruption in CustomTabs.
• Medium CVE-2026-113194: Memory corruption in Core.
• Medium CVE-2026-113189: Use after free in Core.
• Medium CVE-2026-113060: Improper input validation in Bluetooth.
• Medium CVE-2026-113115: Use after free in Transactions Platform.
• Medium CVE-2026-113045: Out of bounds read in Offline.
• Medium CVE-2026-113307: Memory corruption in Extensions.
• Medium CVE-2026-113009: Use after free in WindowControlsOverlay.
• Medium CVE-2026-113071: Use after free in Notifications.
• Medium CVE-2026-113278: Use after free in Extensions.
• Medium CVE-2026-113190: Use after free in ServiceWorker.
• Medium CVE-2026-112992: Memory corruption in Canvas.
• Medium CVE-2026-112995: Use after free in Animation.
• Medium CVE-2026-113261: Use after free in WebAppInstalls.
• Medium CVE-2026-113172: Memory corruption in ServiceWorker.
• Medium CVE-2026-113332: Memory corruption in GPU.
• Medium CVE-2026-113262: Use after free in Extensions.
• Medium CVE-2026-113149: Memory corruption in FullScreen.
• Medium CVE-2026-113206: Memory corruption in Omnibox.
• Medium CVE-2026-113185: Memory corruption in Extensions.
• Medium CVE-2026-113171: Memory corruption in Prompts.
• Medium CVE-2026-113042: Use after free in Extensions.
• Medium CVE-2026-113276: Memory corruption in Passwords.
• Medium CVE-2026-113218: Use after free in DataTransfer.
• Medium CVE-2026-113195: Improper input validation in Downloads.
• Medium CVE-2026-113328: Improper input validation in Privacy.
• Medium CVE-2026-113335: Memory corruption in Extensions.
• Medium CVE-2026-113255: Use after free in CustomTabs.
• Medium CVE-2026-113076: Use after free in Toolbar.
• Medium CVE-2026-113325: Memory corruption in SignIn.
• Medium CVE-2026-113084: Improper input validation in Permissions.
• Medium CVE-2026-113308: Use after free in Core.
• Medium CVE-2026-113224: Memory corruption in WebAppInstalls.
• Medium CVE-2026-113148: Memory corruption in WebUI.
• Medium CVE-2026-113010: Out of bounds read in Extensions.
• Medium CVE-2026-113073: Use after free in Browser.
• Medium CVE-2026-113265: Memory corruption in BFCache.
• Medium CVE-2026-113329: Out of bounds read in Installer.
• Medium CVE-2026-113043: Use after free in iOSWeb.
• Medium CVE-2026-113202: Use after free in BrowserTag.
• Medium CVE-2026-113016: Improper input validation in Extensions.
• Medium CVE-2026-113246: Memory corruption in iOSWebView.
• Medium CVE-2026-113041: Use after free in Actor.
• Medium CVE-2026-113126: Memory corruption in PolicyContainer.
• Medium CVE-2026-113031: Memory corruption in Media.
• Medium CVE-2026-113081: Use after free in Compositing.
• Medium CVE-2026-113139: Memory corruption in Autofill.
• Medium CVE-2026-113128: Missing authorization in Animation.
• Medium CVE-2026-113049: Memory corruption in Core.
• Medium CVE-2026-113032: Memory corruption in Omnibox.
• Medium CVE-2026-113204: Use after free in TrustedWebActivities.
• Medium CVE-2026-113144: Memory corruption in Speech.
• Medium CVE-2026-113054: Out of bounds read in SiteIsolation.
• Medium CVE-2026-113123: Use after free in GPU.
• Medium CVE-2026-113277: Out of bounds read in CustomTabs.
• Medium CVE-2026-113136: Memory corruption in DevTools.
• Medium CVE-2026-113106: Memory corruption in Skia.
• Medium CVE-2026-113001: Use after free in Workers.
• Medium CVE-2026-113064: Memory corruption in OptimizationGuide.
• Medium CVE-2026-113243: Memory corruption in DOM.
• Medium CVE-2026-113326: Memory corruption in Core.
• Medium CVE-2026-113124: Memory corruption in DataTransfer.
• Medium CVE-2026-113230: Improper input validation in Browser.
• Medium CVE-2026-113090: Memory corruption in Interstitials.
• Medium CVE-2026-113158: Use after free in Streaming.
• Medium CVE-2026-113077: Memory corruption in Core.
• Medium CVE-2026-113282: Use after free in Views.
• Medium CVE-2026-113165: Use after free in Core.
• Medium CVE-2026-113178: Memory corruption in Views.
• Medium CVE-2026-113110: Memory corruption in ShadowDOM.
• Medium CVE-2026-113007: Memory corruption in Permissions.
• Medium CVE-2026-113187: Use after free in DOM.
• Medium CVE-2026-113075: Use after free in DevTools.
• Medium CVE-2026-113259: Use after free in Frames.
• Medium CVE-2026-113228: Use after free in Network.
• Medium CVE-2026-113099: Improper input validation in Omnibox.
• Medium CVE-2026-113216: Use after free in Navigation.
• Medium CVE-2026-113270: Use after free in Internals.
• Medium CVE-2026-113087: Use after free in Actor.
• Medium CVE-2026-113267: Memory corruption in Video.
• Medium CVE-2026-113304: Memory corruption in GPU.
• Medium CVE-2026-113177: Use after free in FileSystem.
• Medium CVE-2026-113151: Out of bounds read in Actor.
• Medium CVE-2026-113028: Use after free in Media.
• Medium CVE-2026-113120: Improper input validation in Media.
• Medium CVE-2026-112997: Memory corruption in CSS.
• Medium CVE-2026-113037: Use after free in WebSockets.
• Medium CVE-2026-113153: Memory corruption in SiteIsolation.
• Medium CVE-2026-113138: Memory corruption in WebAppInstalls.
• Medium CVE-2026-113030: Improper access control in V8.
• Medium CVE-2026-113100: Memory corruption in Audio.
• Medium CVE-2026-113221: Use after free in Google Lens.
• Medium CVE-2026-113344: Use after free in Performance.
• Medium CVE-2026-113342: Memory corruption in Network.
• Medium CVE-2026-113159: Improper access control in DevTools.
• Medium CVE-2026-113233: Out of bounds read in Core.
• Medium CVE-2026-113065: Use after free in Media.
• Medium CVE-2026-113002: Memory corruption in Transactions Platform.
• Medium CVE-2026-113199: Out of bounds read in Payments.
• Medium CVE-2026-113197: Use after free in Forms.
• Medium CVE-2026-113203: Use after free in CSS.
• Medium CVE-2026-113170: Use after free in Autofill.
• Medium CVE-2026-113258: Memory corruption in Chromoting.
• Medium CVE-2026-113297: Improper access control in Ozone.
• Medium CVE-2026-113062: Improper input validation in API.
• Medium CVE-2026-113096: Memory corruption in Text.
• Medium CVE-2026-113050: Out of bounds read in HID.
• Medium CVE-2026-113008: Memory corruption in Transactions Platform.
• Medium CVE-2026-113111: Use after free in Compositing.
• Medium CVE-2026-113200: Use after free in ANGLE.
• Medium CVE-2026-113143: Memory corruption in ANGLE.
• Medium CVE-2026-113157: Information leak in ANGLE.
• Medium CVE-2026-113235: Improper input validation in Passwords.
• Medium CVE-2026-113089: Improper input validation in PrintPreview.
• Medium CVE-2026-113340: Memory corruption in ANGLE.
• Medium CVE-2026-113052: Memory corruption in V8.
• Medium CVE-2026-113133: Memory corruption in PlatformIntegration.
• Medium CVE-2026-113086: Improper input validation in Input.
• Low CVE-2026-113251: Use after free in PDF.
• Low CVE-2026-113215: Use after free in Extensions.
• Low CVE-2026-113053: Use after free in Cookies.
• Low CVE-2026-113312: Memory corruption in Autofill.
• Low CVE-2026-113323: Use after free in Chrome for iOS.
• Low CVE-2026-113114: Use after free in SignIn.
• Low CVE-2026-113015: Use after free in Workers.
• Low CVE-2026-113091: Use after free in PerformanceAPIs.
• Low CVE-2026-113168: Use after free in Permissions.
• Low CVE-2026-113229: Use after free in Loader.
• Low CVE-2026-113256: Use after free in Permissions.
• Low CVE-2026-113103: Use after free in WebProtect.
• Low CVE-2026-113056: Memory corruption in PerformanceAPIs.
• Low CVE-2026-113201: Memory corruption in Google Lens.
• Low CVE-2026-113027: Memory corruption in WebFonts.
• Low CVE-2026-113214: Improper input validation in FullScreen.
• Low CVE-2026-113004: Memory corruption in Sync.
• Low CVE-2026-113300: Out of bounds write in Forms.
• Low CVE-2026-113213: Memory corruption in DevTools.
• Low CVE-2026-113167: Memory corruption in Network.
• Low CVE-2026-113223: Memory corruption in DevTools.
• Low CVE-2026-113291: Memory corruption in FullScreen.
• Low CVE-2026-113241: Memory corruption in Toolbar.
• Low CVE-2026-113244: Improper input validation in UI.
• Low CVE-2026-113048: Memory corruption in DevTools.
• Low CVE-2026-113247: Memory corruption in DevTools.
• Low CVE-2026-113023: Improper input validation in Extensions.
• Low CVE-2026-113330: Memory corruption in CustomTabs.
• Low CVE-2026-113226: Memory corruption in Model.
• Low CVE-2026-113152: Memory corruption in SignIn.
• Low CVE-2026-113029: Improper access control in ANGLE.
• Low CVE-2026-113296: Memory corruption in Actor.
• Low CVE-2026-113306: Improper input validation in Network.
• Low CVE-2026-113245: Memory corruption in DevTools.
• Low CVE-2026-113299: Memory corruption in WebProtect.
• Low CVE-2026-113024: Use after free in WebAppInstalls.
• Low CVE-2026-113025: Use after free in Input.
• Low CVE-2026-113080: Use after free in WebAppInstalls.
• Low CVE-2026-113186: Memory corruption in DevTools.
• Low CVE-2026-113180: Memory corruption in ContentCapture.
• Low CVE-2026-113140: Use after free in ANGLE.
• Low CVE-2026-113184: Memory corruption in Scheduling.
• Low CVE-2026-113017: Use after free in Views.
• Low CVE-2026-112998: Memory corruption in Views.
• Low CVE-2026-113021: Use after free in WebAppInstalls.
• Low CVE-2026-113145: Memory corruption in Messages.
• Low CVE-2026-113292: Improper input validation in Omnibox.
• Low CVE-2026-113156: Use after free in Messages.
• Low CVE-2026-113116: Use after free in DevTools.
• Low CVE-2026-113047: Memory corruption in BrowserTag.
• Low CVE-2026-113173: Improper input validation in UI.
• Low CVE-2026-113260: Memory corruption in Core.
• Low CVE-2026-113269: Memory corruption in BrowserTag.
• Low CVE-2026-113036: Memory corruption in HTML.
• Low CVE-2026-113268: Memory corruption in Navigation.
• Low CVE-2026-113038: Memory corruption in DevTools.
• Low CVE-2026-113313: Memory corruption in DevTools.
• Low CVE-2026-113061: Memory corruption in Chromoting.
• Low CVE-2026-113248: Memory corruption in FileSystem.
• Low CVE-2026-113288: Memory corruption in Core.
• Low CVE-2026-113085: Use after free in Media.
• Low CVE-2026-113107: Use after free in Media.
• Low CVE-2026-113066: Memory corruption in Fonts.
• Low CVE-2026-113121: Memory corruption in ContextMenu.
• Low CVE-2026-113287: Use after free in Prompts.
• Low CVE-2026-113132: Memory corruption in DevTools.
• Low CVE-2026-113169: Memory corruption in WebAppInstalls.
• Low CVE-2026-113254: Memory corruption in DevTools.
• Low CVE-2026-113063: Improper input validation in Chromoting.
• Low CVE-2026-112994: Memory corruption in Browser.
• Low CVE-2026-113314: Use after free in Media.
• Low CVE-2026-113237: Memory corruption in Chromoting.
• Low CVE-2026-113331: Memory corruption in Controls.
• Low CVE-2026-113182: Memory corruption in Passwords.
• Low CVE-2026-113046: Improper input validation in Passwords.
• Low CVE-2026-113067: Use after free in Chromoting.
• Low CVE-2026-113074: Use after free in Media.
• Low CVE-2026-113130: Use after free in Actor.
• Low CVE-2026-113294: Improper input validation in Loader.
• Low CVE-2026-112996: Memory corruption in Loader.
• Low CVE-2026-113122: Memory corruption in Loader.
• Low CVE-2026-113227: Use after free in Editing.
• Low CVE-2026-113286: Memory corruption in Google Lens.
• Low CVE-2026-113083: Memory corruption in Actor.
• Low CVE-2026-113088: Memory corruption in Mobile.
• Low CVE-2026-113013: Memory corruption in DevTools.
• Low CVE-2026-113125: Memory corruption in DevTools.
• Low CVE-2026-113039: Use after free in Bookmarks.
• Low CVE-2026-113274: Use after free in ReadingMode.

The Jackson project reports:

Type parameters of generic type ids, and element types of array type ids, were not passed to the configured PolymorphicTypeValidator, so a deny-listed type could be reached through a type parameter.

They are now validated like direct type ids. Approval by base type only covers subtypes of that base type, allowIfSubTypeIsArray() no longer accepts abstract or interface element types without allow-listing, and approval of an array type covers its element type only when given as exactly that class.

The Jackson project reports:

CVE-2026-91776: TypeDeserializerBase caches the resolved deserializer under the raw, attacker supplied type id. With name based polymorphism and a fallback, every unrecognized type id adds an entry and the cache grows without bound.

CVE-2026-91777: forward reference completion for JsonIdentityInfo object ids scans the pending reference accumulator for every resolved id, which is quadratic in the number of references.

The Jackson project reports:

CVE-2026-89407: NumberInput.looksLikeValidNumber() pre-validates stringified numbers with PATTERN_FLOAT, whose adjacent quantifiers allow catastrophic backtracking on crafted input.

CVE-2026-89425: UTF8DataInputJsonParser builds the offending token text for an error message in a loop without an upper bound, so it ignores maxErrorTokenLength. The other three parser implementations are not affected.

-Brotli project reports:

CVE-2026-111497: out-of-bounds write permits remote code execution.

DBI project reports:

Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann).

PowerDNS reports:

• CVE-2026-73206: A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet
• CVE-2026-73205: A malicious client can cause too many TCP connections in TIME_WAIT state
• CVE-2026-85555: DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution
• CVE-2026-85556: Missing OPT RR owner-name validation bypasses ECS hardening
• CVE-2026-85557: Single web client not doing TLS handshake monopolizes web access
• CVE-2026-85558: Recursor retains closed TCP client addresses until process exit
• CVE-2026-85559: Out-of-bounds read in Recursor findScopeZero

The PHP project reports:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

NLNetLabs reports:

This release consolidates security fixes for issues reported over a period of time.

• CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments.
• CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
• CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service.
• CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by ‘unwanted-reply-threshold’.
• CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record.

Problem Description:

eMudhra generated several of its TLS intermediate CA certificates using a flawed procedure that used trivially small private keys. The keys have been recovered by several parties and publicly disclosed. The intermediates are signed by the "emSign ECC Root CA - G3" root certificate, which was included in the trusted certificate bundle.

The intermediates have been revoked, but OpenSSL does not check certificate revocation by default.

The corrected bundle marks "emSign ECC Root CA - G3" as untrusted. It also incorporates the other root certificate additions and removals in NSS 3.131.1.

Impact:

An attacker able to intercept network traffic can use the compromised keys to issue a certificate that impersonates any TLS server, allowing the traffic to be read or modified without detection.

Problem Description

TRAMP (Transparent Remote (file) Access, Multiple Protocol) is a part of Emacs that provides an interface for editing remote files transparently. It builds the login command for a remote connection from tramp-login-args by joining the expanded values without quoting and passes the resulting string to a local shell. The user name part of a remote file name may contain shell metacharacters, and nothing sanitizes them. Because the file name dispatch regexp was anchored to the start of a line rather than the start of the string, a file name containing a newline followed by a remote file name syntax, for example in a symbolic link target, is handed to TRAMP.

The first fix (CVE-2026-79992), included in Emacs 31.1, excluded shell metacharacters from TRAMP user names, but tramp-user-regexp still permitted "!", "#", "&", "," and control characters. User and host names were also not re-validated after environment variable expansion, and the values of tramp-default-user and tramp-default-host were not validated at all. This incomplete fix was assigned CVE-2026-108976. The commit completing the fix cites CVE-2026-79992 because it was written before the second identifier was published. The FreeBSD Emacs package versions 31.1,3 through 31.1_2,3 and emacs-devel snapshots from 32.0.50.20260902 through 32.0.50.20261001 are affected only by CVE-2026-108976.

Impact

Merely processing a crafted file name, for example with file-exists-p, executes the embedded command with the privileges of the user running Emacs. No remote connection has to succeed.

Anki developers report:

Security: Prevent external links in deck descriptions rendered in the overview/congrats screen from manipulating the page in certain cases when clicked.

The Roundcube Mail project reports:

• IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• bug where an alias login wasn’t qualified by IMAP host
• Add a size limit to the CSS proxy content processing
• SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• remote content blocking bypass via SVG SMIL by attribute
• remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• passing potentally unsafe attachment content into ImageMagick on image resize
• mail header injection via the From display-name in the Bounce (resend) action
• mail header injection via References/In-Reply-To/Message-ID/From parameters
• object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys
• ImageMagick resource limits bypass by GD fallback during thumbnail generation
• CSS scoping bypass in HTML messages using at-rules
• bug where deprecated action aliases bypassed disabled_actions setting
• IMAP command injection via CRLF in _flag parameter of mail/mark action
• CSRF validation bypass in the mark-as-junk action
• XSS issue in handling of password driver error responses
• mail header injection via subject of a message forwarded as attachment
• mail header injection via media type in an inline image data URI
• bug where Password Modoboa driver could change password for another account
• unsafe use of a login name in SquirrelMail import file path

The Erlang/OTP project reports:

OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues, three of which complete earlier incomplete fixes:

• CVE-2026-105236: (D)TLS-1.2 session resumption could cross SNI virtual-host boundaries. An SNI-aware server resumed a cached session even when the resumption request's server_name differed from the one that established it, so a client could bypass the client-authentication boundary of a second virtual service and skip the certificate exchange.
• CVE-2026-94200: a malicious or man-in-the-middle TLS-1.3 server could poison a client's ticket store with a NewSessionTicket carrying a zero-length early_data extension. A client using automatic session-ticket management stored the ticket and crashed on a later resumption, taking down the node-global client ticket store.
• CVE-2026-42789: the earlier fix for certificate chain forgery via non-CA intermediates in public_key left the X.509 version 1 and version 2 path uncovered. Such certificates carry no basicConstraints and are now rejected in issuer position.
• CVE-2026-48856: the earlier fix for credential leaks on cross-origin httpc redirects did not clear the userinfo component of the request URI, so credentials given as http://user:password@host/path were still sent to the redirect target.
• CVE-2026-70405: the earlier byte-length bounds on snmp varbind values did not cover the v3 header fields, the USM security parameters or the PDU integer fields, which could still be decoded into arbitrarily large integers.

https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382 reports:

A loop with unreachable exit condition ('infinite loop') vulnerability in the erl_tar module allowed an attacker who supplied a tar archive to cause a denial of service via a crafted GNU sparse member with a trailing hole.

The traefik project releases a new version addressing multiple vulnerabilities:

• GHSA-p8wx-ph99-xgcr (mTLS (auth-tls-secret) silently disabled for a host)
• GHSA-ww7c-q3mv-xx22 (Data race on the shared bufio.Reader)
• GHSA-28hp-c82p-8vqj (TLS-option cache hit skips the cross-namespace authorization check)

X.Org reports:

Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.

• CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser
• CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop

X.Org reports:

Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.

• CVE-2026-88807: Out-of-bounds read in libXrender's XRenderQueryFormat reply parser

X.Org reports:

Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.

• CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path

X.Org reports:

Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.

• CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState()
• CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()
• CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser
• CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing
• CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices()
• CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing
• CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.
• CVE-2026-109089: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
• CVE-2026-109090: libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

X.Org reports:

Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.

• CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB (X Keyboard Extension) action parser
• CVE-2026-94283: Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser
• CVE-2026-94284: Out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser
• CVE-2026-94285: Out-of-bounds read in libX11's byte-oriented codeset parser

Graham Dumpleton reports:

A race condition at process startup could let two threads be handed the same per-thread record, because records were allocated from an Apache memory pool shared by every thread without a lock. Threads sharing a record also shared the mod_wsgi.thread_id value and, for named application groups, the same Python thread state, so one request's context (such as session data) could leak into another concurrent request. On Python 3.14 and later the shared thread state could instead crash the worker process.

An integer underflow in the SOAPAction header parsing in ParseHttpHeaders() lets a remote attacker trigger an out-of-bounds read by sending a malformed SOAPAction header containing a single quote. This can crash miniupnpd or disclose memory beyond the HTTP request buffer.

H.Merijn Brand - Tux <linux@tux.freedom.nl> reports:

Text::CSV_XS versions before 1.65 have these vulnerabilities listed below.

• CVE-2026-110759: parse (): report trailing lone CR, do not store EOF as 0xFF
• CVE-2026-110758: Under allow_whitespace, do not strip beyond field start
• CVE-2026-110757: combine (): decide quoting from the bytes, not the NV flags
• CVE-2026-110756: Flush saved bytes in Combine ()
• CVE-2026-110755: Re-use AHEAD with \r instead of copying
• CVE-2026-110754: getline (): free the result array when the parse fails
• CVE-2026-110753: Do not free the bound column scalar in skip_empty_rows
• CVE-2026-110752: fragment (): do not size memory by the selector integers

NLnet Labs reports:

This security release has fixes for vulnerabilities which were all for cases with specially crafted and formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which NSD is secondary, would not be formatted like this. The zone file had to be fed to NSD directly, but could in multi-tenant configurations, come from an operator controlled provisioning system accessible to third parties. Zone files that are regularly formatted (generated from DNS software) or come from trusted sources would not trigger these vulnerabilities.

• CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase.
• CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim.
• CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
• CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes.

Newsboat Team reports:

• (CVE ID Pending) Remote code execution via manual OPML import (--import-from-opml)
• GHSA-4m8m-vj3m-hfxx: Remote code execution via OPML import (both manual --import-from-opml and opml-url config setting)
• GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths

The ngx_cache_purge developers report:

Fixed a symlink traversal vulnerability during cache tree traversal. An attacker with the ability to create symbolic links inside the cache directory could potentially cause cache purge operations to delete arbitrary files accessible to the NGINX worker process (CVE-2026-108981).

Problem Description:

Several vulnerabilities were found in the bhyve hypervisor's device models.

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. (CVE-2026-101309)

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. (CVE-2026-101310)

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. (CVE-2026-101311)

Impact:

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

Problem Description:

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.

Impact:

An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

Problem Description:

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.

Impact:

A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.

The nginx developers report:

A buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path (CVE-2026-15176).

A buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).

When using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the "client_max_body_size" limit or injecting data in the proxied request (CVE-2026-95101).

When using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).

When using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has "include virtual" commands (CVE-2026-97205).

Plack project reports:

[SECURITY]

• Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333)
• Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332)
• Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335)

[BUG FIXES]

• Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer middleware such as AccessLog sees the original request (CVE-2026-110334)

[BUG FIXES]

• Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and warn against relying on front-server path-based access control (CVE-2026-110336)

The Curl project reports:

• local interface connection reuse mixup (CVE-2026-107929)
• info leak uploading over WebSockets with GnuTLS (CVE-2026-107928)
• password leak in CURLINFO_EFFECTIVE_URL (CVE-2026-94266)
• Authorization: Negotiate sent to foreign origin (CVE-2026-94265)
• server-set cookie aborts cookie jar load (CVE-2026-92386)
• never-ending loop via server response omission (CVE-2026-92387)
• FTP wildcard write callback mixup (CVE-2026-92388)
• TFTP direction confusion (CVE-2026-92389)
• -J no-clobber guarantee bypassed with 103 early hints (CVE-2026-92390)
• curl_mime_free stack overflow by recursion (CVE-2026-92391)
• HTTP/2 upload Use-After-Free (CVE-2026-92392)
• redirect to SFTP or SCP bypasses host verification (CVE-2026-86410)
• server-set cookie erases cookie jar (CVE-2026-86412)
• Negotiate credentials sent to redirected origin (CVE-2026-86413)
• leaking host credentials to HTTP proxy (CVE-2026-86414)
• auto client cert connection reuse mixup (CVE-2026-86415)
• cross-origin reuse of a Negotiate connection (CVE-2026-87861)
• HSTS cache import drops longer-lived child (CVE-2026-87862)
• HSTS response erases persisted entries (CVE-2026-87863)
• knownhost callback mismatches key as missing (CVE-2026-87865)
• wolfSSL public-key pinning bypass (CVE-2026-87866)

Wasmtime development team reports:

• Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow.
• Mis-typed WebAssembly tag imports can lead to GC heap corruption.
• Rooting for GC values live across try_call may be missing, causing GC heap corruption.
• Excessive allocated memory on the host when guests don't have stdio.
• Guest can panic host through filesystem timestamp before the epoch on wasip3.
• Wasmtime wasi:http implementation panics with a zero timeout supplied.
• WASI preview 0 implementation of poll_oneoff circumvents fuel consumption.
• fd_readdir copies uninitialized struct padding into guest memory.

Helder Eijs reports

Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures The signing time depended on the secret nonce, enough to recover the private key with a lattice attack. - EC: scalars are encoded and processed on the full length of the order, and ec_mix_add() is constant time for the point at infinity (a zero digit). - DSA: g^k uses k + q or k + 2q (fixed length) and mpz_powm_sec, or the library's Montgomery exponentiation without GMP. About 40% slower.

Gitlab reports:

Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE

Cross-site Scripting issue in syntax highlighting impacts GitLab CE/EE

Improper Authorization issue in downstream pipeline creation service impacts GitLab CE/EE

Permissive Regular Expression issue in repository file access impacts GitLab CE/EE

Incorrect Authorization issue in scheduled pipeline execution policy impacts GitLab EE

Improper Neutralization of Input Used for LLM Prompting issue in GitLab Duo Agent Platform impacts GitLab EE

Sensitive Information Exposure issue in GitLab Pages impacts GitLab CE/EE

Open Redirect issue in Kubernetes proxy impacts GitLab CE/EE

Incorrect Authorization issue in GraphQL notes widget impacts GitLab CE/EE

Incorrect Authorization issue in GraphQL work item hierarchy impacts GitLab CE/EE

Incorrect Authorization issue in GraphQL scope impacts GitLab CE/EE

Page cache poisoning via improper cache key construction in merge requests impacts GitLab CE/EE

Incorrect Authorization issue in work items GraphQL API impacts GitLab CE/EE

Missing Authorization issue in merge request accessibility report comparison endpoint impacts GitLab CE/EE

Incorrect Privilege Assignment issue in custom roles impacts GitLab EE

Insufficient Granularity of Access Control issue in project label management impacts GitLab CE/EE

Governance Control Bypass issue in Duo Agent Platform impacts GitLab EE

Incorrect Authorization issue in package registry impacts GitLab CE/EE

Incorrect Authorization issue in merge request approval eligibility check impacts GitLab EE

Incorrect Authorization issue in fine-grained personal access tokens impacts GitLab CE/EE

Server Side Request Forgery (SSRF) issue in repository import impacts GitLab CE/EE

Incorrect Authorization issue in project import impacts GitLab CE/EE

Incorrect Authorization issue in Package Registry impacts GitLab CE/EE

Improper Access Control issue in project CI/CD settings impacts GitLab EE

The GStreamer project reports:

Multiple security issues were identified and fixed in the GStreamer framework.

• GStreamer-SA-2026-0078: Type confusion crash in GValue list comparison when parsing caps
• GStreamer-SA-2026-0083: Out-of-bounds read and write in GStreamer video meta deserialization
• GStreamer-SA-2026-0084: Out-of-bounds read in the RTSP KeyMgmt header parser
• GStreamer-SA-2026-0085: Stack-based out-of-bounds write in closed caption converter and combiner
• GStreamer-SA-2026-0086: Out-of-bounds read in H.265 RTP depayloader when processing short packets
• GStreamer-SA-2026-0087: Excessive memory allocation in the ASF demuxer
• GStreamer-SA-2026-0088: Heap out-of-bounds write in RTP L8/L16/L24 audio depayloaders
• GStreamer-SA-2026-0089: Integer overflow and out-of-bounds read in Matroska demuxer Xiph codec data parser
• GStreamer-SA-2026-0090: Arbitrary element instantiation in GStreamer Editing Services project file loader
• GStreamer-SA-2026-0091: Out-of-bounds read in RTCP SDES privately defined entry handling
• GStreamer-SA-2026-0092: Out-of-bounds read in SVG image decoder

The Podman developers report:

This release addresses (CVE-2026-94603), where a "podman run" on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created.

Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security configuration and are very difficult to run safely.

cve@mitre.org reports:

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.

The WsgiDAV project reports:

When follow_symlinks is false (the default), WsgiDAV is expected to prevent serving content through symbolic links - a request for a symlink returns 403 Forbidden: Symlink support is disabled. However, that guard inspects only the leaf component of the resolved path, and the root-containment check is purely lexical (os.path.abspath, which does not resolve symlinks).

As a result, a symlink used as an intermediate directory in the request path is neither blocked by the guard nor caught by the containment check, and the request escapes the configured share root. This allows reading, writing, and deleting files outside the root.

ejabberd team reports:

• Unauthenticated Remote Code Execution on ejabberd (reported by Gia Bui) when:
  • ejabberd versions is at least 25.10
  • BOSH is enabled on any port
  • S2S is enabled
  • mod_adhoc_api is loaded
  • outbound connectivity from ejabberd on ports epmd (default 4369), s2s (default 5269) and Erlang distribution port (dynamically assigned, typically in the range 49152-65535 unless FIREWALL_WINDOW is set in ejabberdctl.cfg).
• DoS attack on 16.12+ versions if BOSH is enabled on any port.
• Cross-Tenant MUC, Roster and Shared-Roster unauthorized access (reported by Hoang Gia).

Kevin J. McCarthy reports:

Fixing an OOB heap write. This is triggered by a specially crafted Content-Header line in an email that is used as a template for a new email, via <resend-message >. Thanks to Calif.io, in collaboration with Anthropic for sending me a detailed write up and suggested patch.

Drupal core reports:

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

The traefik project releases a new version addressing multiple vulnerabilities:

• GHSA-53qr-784g-cj35 (FastProxy backend connection pool leaks identity)
• GHSA-cw35-4q88-3rmp (NTLM/Kerberos sticky round tripper is not keyed by service)
• GHSA-fh26-gfpp-7xxx (snicheck skips the check when `req.TLS` is nil)
• GHSA-mwrr-6hp4-pxr6 (Ingress-NGINX provider forwards forged Ssl-Client-* identity headers
• GHSA-qm9f-w54v-q2qh (Preauthenticated Negotiate contaminates Traefik's backend connection pool
• GHSA-qvj7-gq9c-hp7q (ssl-passthrough sibling HTTP router serves the auth-protected backend without auth)
• GHSA-rv2h-qh7j-xrjw (colliding auth-tls-secret names merge two client CAs into one TLS option)
• GHSA-mhjw-hmjv-p99x (Unsynchroinized write to sticky round tripper shared by concurrent HTTP/2 streams)

The ClamAV project reports:

• CVE-2026-20345: indexing error while converting GPT partition names could read or write beyond a stack-allocated partition entry.
• CVE-2026-20339: integer overflow in the PESpin unpacker could allocate an undersized buffer and write beyond it.
• CVE-2026-20346: integer underflow in the PDF parser could cause a crash while reading a malformed hex string.
• CVE-2026-20347: undefined behavior and integer overflow in the Mach-O parser could cause a crash on a malformed file.
• CVE-2026-20348: XAR parser size handling could request an excessive allocation or exceed scan limits.
• CVE-2025-8088: path separators in NTFS alternate data stream names in the bundled UnRAR library could lead to extraction outside the temporary scan directory.
• CVE-2026-20217: PESpin unpacker cleanup path could free pointers into the scanned file buffer and crash the scanner.
• CVE-2026-20213: integer overflow in PE rebuild size calculations could lead to a heap buffer overflow write.
• CVE-2026-20216: InstallShield archive extraction limit bypass could exhaust temporary storage.
• CVE-2026-20214: FSG unpacker loop underflow could write past the section array.
• CVE-2026-20243: ALZ parser size handling bugs could abort the scanner.
• CVE-2026-20215: 7z parser substream count overflow could write past under-allocated metadata arrays.
• CVE-2026-20244: 32-bit DMG parser size checks could crash 32-bit scanner builds.
• Thread-safety issues in the clamd STATS command could disclose process memory or crash the daemon.

The OpenSSH project reports:

• sftp(1): more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory.
• sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI credentials when authentication has succeeded. Avoids a situation where credentials from a failed GSSAPIAuthentication attempt may persist and be made inappropriately available if another authentication subsequently succeeds.
• sshd(8): reset GSSAPIAuthentication before authentication, avoiding state from one authentication attempt being confused with that of a later attempt.
• sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate the side-channel leaks described in "Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels"
• ssh(1): disallow '$' and '\' characters in usernames entered on the command-line to avoid usernames from untrusted sources yielding injection in shell context via ProxyCommand, Match exec, etc. Usernames specified via the configuration files are not subject this this control.
• ssh-keygen(1): correct handling of Daylight Saving Time when converting dates. Previous handling could cause errors of up to +/- 1 hour (unless you are in the Antarctica/Troll timezone, where the error could be +/- 2 hours). These errors could result in creation of certificates with incorrect expiry times.
• sshd(8), ssh(1): ensure that compressed payloads don't inflate past the maximum supported packet length.
• sshd(8): fully honor the authorized_keys "restrict" keyword, which was not being properly applied to tunnel forwarding (PermitTunnel, disabled by default).
• sshd(8): correctly handle some options that accept "none". Some options, including AuthorizedPrincipalsFile, were documented as accepting "none" as a way to disable them; however, when overridden by an sshd_config(5) Match keyword, this argument was being incorrectly interpreted as a literal file.
• sshd(8): on platforms that do not support file descriptor passing and that require root for PTY allocation, the post-authentication sshd-session process retains root privilege, whereas on other platforms this process runs with the privilege of the logged-in user. When sshd-session was run with elevated privilege, it could perform certain actions as root and circumvent controls that would normally have applied to the user, such as making unix domain socket connections or binding (via -R forwarding) to low- numbered TCP ports.

X.Org reports:

Multiple issues have been found in the X server and Xwayland implementations published by X.Org for which we are releasing security fixes for in xorg-server-21.1.25 and xwayland-24.1.14. CVE-2026-88812: XKB SetGeometry TextDoodad Double Free CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow CVE-2026-93518: XKB ResizeKeyType Numeric Truncation CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read CVE-2026-93536: GestureBuildSprite Use-After-Free

The rabbitmq-c project reports:

A malicious AMQP peer can trigger memory exhaustion in rabbitmq-c clients by sending frames with unrecognised types or invalid channel numbers. The client allocates per-channel memory pools and stores complete frames before validating the channel against the negotiated limits or the frame type, and discards unknown frames without releasing that memory, allowing a sustained stream of small frames to exhaust client resources.

The rabbitmq-c project reports:

CVE-2026-61547: A heap buffer overflow exists when the amqp_send_frame() API is used to serialise an oversized AMQP_FRAME_BODY frame, as memcpy() writes past the end of the heap allocation without validating that the body fragment fits within the allocated frame buffer.

CVE-2026-59986: An integer overflow in the amqp_decode_bytes bounds check on 32-bit systems allows a malicious AMQP broker to craft frames with oversized BYTES fields, resulting in an out-of-bounds read that may expose process memory or crash the application.

The rabbitmq-c project reports:

CVE-2026-44236: A malicious AMQP server can send an undersized connection.tune.frame_max value during the login handshake. The library does not enforce the protocol minimum frame size, reallocates its outbound buffer to an invalid size and then writes frame data beyond it, causing a heap buffer overflow before authentication completes.

CVE-2026-44235: An unsigned integer underflow in the frame length computation when parsing undersized AMQP frames bypasses bounds checks in the property and table decoders, leading to an out-of-bounds read and client-side denial of service.

The Vaultwarden project reports:

• Organization member revocation [GHSA-69q9-v8p6-xvx3] (High, 8.1)
• Two-factor authentication [GHSA-7jg8-8m5x-6j9r] (Medium, 6.8)
• Organization invitations [GHSA-v576-3wvq-xh3c] (Medium, 6.8)
• Attachments [GHSA-q5x6-grh5-fqgc] (Medium, 6.5)
• Organization event logs [GHSA-64mc-4p6f-r7x9] (Medium, 4.3)
• Cipher sharing [GHSA-7ccc-c43j-4p36] (Medium, 4.3)
• Organization API key [GHSA-qwx4-wcv4-mpcv] (Low, 3.8)

The LibreSSL project reports:

• Ensure verify callbacks always returning 1 can see a hostname mismatch
• Correct botched size check in dtls1_preprocess_fragment()
• Limit size of buffered DTLS handshake messages
• Avoid potential overread on interrupted retransmission in DTLS
• Fix OCSP responder authorization bypass in libtls and ocspcheck(8)

ISC team reports:

CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching

CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof

CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add()

CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver

CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request

CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement

CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts

CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof

CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references

https://github.com/libexpat/libexpat/pull/1282 reports:

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

The Keycloak Team reports:

• [CVE-2026-12388]: IdP mapper admin role escalation.
• [CVE-2026-14781]: OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified.
• [CVE-2026-19608]: Name-only group claims let same-name groups satisfy path-specific group policies.
• [CVE-2026-54515], [CVE-2026-59889]: Third-party dependency fix, com.fasterxml.jackson.core:jackson-databind 2.22.0.
• [CVE-2026-59903]: Third-party dependency fix, io.netty:netty-codec-http:4.1.136.Final.

The Apache httpd project reports:

• limited RCE for some internal redirects to non-CGI files in CGI directories (CVE-2026-42356) [low]
• mod_dav shared lock overflow (CVE-2026-42528) [moderate]
• mod_heartmonitor denial of service (CVE-2026-46729) [low]
• mod_session: Session cookie not removed during internal redirect (CVE-2026-47360) [low]
• mod_auth_digest reauthentication attack (CVE-2026-48005) [low]
• mod_charset_lite: Heap overflow in finish_partial_char (CVE-2026-56153) [low]
• mod_rewrite use-after-free via %{LA-U:HTTP:...} (CVE-2026-56154) [low]
• mod_proxy_html: crash in dump_content (CVE-2026-56449) [low]
• mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941) [moderate]
• mod_dav_fs property database read access (CVE-2026-58415) [low]
• Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM (CVE-2026-59685) [moderate]
• mod_ssl SSLRequire allows .htaccess ap_expr file-function (CVE-2026-59797) [low]
• mod_proxy_ftp PASV address handling (CVE-2026-63045) [low]
• mod_vhost_alias stack overflow (CVE-2026-63292) [moderate]
• mod_xml2enc crash on charset conversion failure (CVE-2026-63686) [low]
• mod_proxy_uwsgi Transfer-Encoding response smuggling (CVE-2026-63718) [low]
• mod_auth_digest one-time-nonce replay attack (CVE-2026-73636) [low]
• mod_auth_digest DoS attack (CVE-2026-73637) [low]
• mod_userdir information disclosure (CVE-2026-79768) [low]
• mod_dav_fs namespace overflow (CVE-2026-93546) [moderate]

Torproject reports:

Various security issues discovered in versions below 2.7.0.

OSS-Fuzz, Gary Gregory reports:

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Conduit team reports:

Fixes a vulnerability allowing an attacker with an account on the server to gain access to any other account. It is recommended you upgrade ASAP.

Problem Description:

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.

Impact:

A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

Problem Description:

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.

Impact:

A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

Problem Description:

Three flaws allow a jailed process to bypass FD_RESOLVE_BENEATH:

1. When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. (CVE-2026-101304)
2. renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. (CVE-2026-101305)
3. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. (CVE-2026-101306)

Impact:

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Problem Description:

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. (CVE-2026-58099)

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. (CVE-2026-58100)

Impact:

An unprivileged local user may be able to exploit these races to escalate privileges.

Problem Description:

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds.

Impact:

An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.

The OpenSSL project reports:

• DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) [High]
• Use-After-Free in X.509 Extension Cache Under Concurrent Use (CVE-2026-84783) [Moderate]
• Excessive Memory Allocation in Relative CRLDP Processing (CVE-2026-35189) [Low]
• QUIC Unvalidated Amplification Credit may be Over Accounted (CVE-2026-35191) [Low]
• Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC (CVE-2026-42772) [Low]
• Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (CVE-2026-54872) [Low]
• QUIC STREAM Fragment Metadata DoS (CVE-2026-54873) [Low]
• Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (CVE-2026-54875) [Low]
• Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (CVE-2026-72897) [Low]
• QUIC Connection-Level Flow Control is Not Enforced for Streams (CVE-2026-75804) [Low]
• NULL Pointer Dereference in CMP Client Revocation Response Handling (CVE-2026-75805) [Low]
• Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (CVE-2026-75806) [Low]
• Timing Side-Channel in SM2 Signature Generation (CVE-2026-77696) [Low]
• QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (CVE-2026-84784) [Low]

Fetchmail reports:

[CVE-2026-94184]: Fetchmail's NTLM authentication client can in some cases be susceptible to a remote code execution from a malicious server when fetchmail is configured with the NTLM feature enabled, depending on build details. fetchmail 6.6.7 release candidates, 6.6.7 and subsequent releases are unaffected.

Chrome Releases reports:

This update includes 108 security fixes:

• [551573368] Critical CVE-2026-95350: Buffer overflow in ANGLE.
• [530045332] Critical CVE-2026-95357: Out of bounds write in GPU.
• [548585299] Critical CVE-2026-95339: Use after free in ServiceWorker.
• [551708184] Critical CVE-2026-95281: Buffer overflow in ANGLE.
• [552665794] Critical CVE-2026-95313: Use after free in Fullscreen.
• [553172761] Critical CVE-2026-95349: Buffer overflow in WebGL.
• [556435507] Critical CVE-2026-95284: Buffer overflow in ANGLE.
• [556576992] Critical CVE-2026-95322: Out of bounds write in GPU.
• [559320837] Critical CVE-2026-95329: Out of bounds write in WebGL.
• [560439699] Critical CVE-2026-95356: Use after free in WindowDialog.
• [562151598] Critical CVE-2026-95310: Use after free in AdFilter.
• [540265100] High CVE-2026-95301: Missing authorization in Extensions.
• [543471693] High CVE-2026-95291: UI misrepresentation in SecurityIndicators.
• [508462481] High CVE-2026-95355: Incorrect authorization in Navigation.
• [517661385] High CVE-2026-95315: Use after free in Aura.
• [520516206] High CVE-2026-95298: Use after free in Browser.
• [534997484] High CVE-2026-95372: Use after free in Chromecast.
• [537857253] High CVE-2026-95324: Uninitialized resource in GPU.
• [543141419] High CVE-2026-95283: Buffer overflow in Tint.
• [550953039] High CVE-2026-95293: Uninitialized resource in GPU.
• [553116160] High CVE-2026-95274: Improper output encoding in DevTools.
• [553129513] High CVE-2026-95282: Use after free in Platform.
• [553130481] High CVE-2026-95373: Use after free in DevTools.
• [553136141] High CVE-2026-95277: Use after free in Views.
• [554558320] High CVE-2026-95348: Use after free in Bluetooth.
• [555299641] High CVE-2026-95335: Use after free in HID.
• [556535630] High CVE-2026-95338: Use after free in PDFium.
• [556576976] High CVE-2026-95318: Buffer overflow in Video.
• [557523002] High CVE-2026-95286: Type confusion in Bindings.
• [558764482] High CVE-2026-95365: Type confusion in IndexedDB.
• [559815527] High CVE-2026-95343: Use after free in WebAudio.
• [560406548] High CVE-2026-95280: Race condition in V8.
• [560536731] High CVE-2026-95304: Out of bounds write in V8.
• [560536735] High CVE-2026-95306: Type confusion in V8.
• [561997427] High CVE-2026-95299: Use after free in GPU.
• [562242429] High CVE-2026-95351: Use after free in Views.
• [495529018] Medium CVE-2026-95287: Missing authorization in Navigation.
• [497204165] Medium CVE-2026-95366: Use of released resource in Core.
• [497212105] Medium CVE-2026-95382: Improper input validation in Auth.
• [497603247] Medium CVE-2026-95381: Improper input validation in Printing.
• [500127519] Medium CVE-2026-95331: Out of bounds write in ANGLE.
• [501648493] Medium CVE-2026-95297: Missing authorization in Contextual Tasks.
• [502179319] Medium CVE-2026-95375: Incorrect authorization in BrowserTag.
• [502242455] Medium CVE-2026-95302: Incorrect authorization in WebAPKs.
• [511791538] Medium CVE-2026-95362: Cross-site request forgery in DevTools.
• [513049042] Medium CVE-2026-95369: Inappropriate implementation in XML.
• [513134076] Medium CVE-2026-95376: Externally controlled reference in DevTools.
• [513162143] Medium CVE-2026-95359: Uninitialized resource in GPU.
• [513992281] Medium CVE-2026-95294: UI misrepresentation in Browser.
• [514019137] Medium CVE-2026-95337: UI misrepresentation in Messages.
• [514059630] Medium CVE-2026-95346: UI misrepresentation in Chromoting.
• [514072284] Medium CVE-2026-95320: Missing authorization in Navigation.
• [514487499] Medium CVE-2026-95317: Incorrect authorization in MediaCapture.
• [516404074] Medium CVE-2026-95345: Use after free in Actor.
• [517163294] Medium CVE-2026-95330: Improper state validation in Downloads.
• [517417437] Medium CVE-2026-95370: Inappropriate implementation in NFC.
• [517442714] Medium CVE-2026-95303: Incomplete cleanup in SmartCard.
• [517584808] Medium CVE-2026-95360: Race condition in Editing.
• [517596255] Medium CVE-2026-95295: Information leak in Mobile.
• [517730821] Medium CVE-2026-95276: Improper input validation in Themes.
• [517802696] Medium CVE-2026-95314: Incorrect authorization in HID.
• [520504291] Medium CVE-2026-95371: Missing authorization in Views.
• [522061704] Medium CVE-2026-95353: Use after free in Bindings.
• [522344883] Medium CVE-2026-95363: UI misrepresentation in FileSystem.
• [523719002] Medium CVE-2026-95341: Improper input validation in Desktop.
• [524582798] Medium CVE-2026-95354: Use after free in Verifier.
• [526550688] Medium CVE-2026-95384: Race condition in Transactions Platform.
• [532962621] Medium CVE-2026-95336: Information leak in Transactions Platform.
• [536161355] Medium CVE-2026-95290: Missing authorization in NFC.
• [536648933] Medium CVE-2026-95325: Use after free in ANGLE.
• [542926849] Medium CVE-2026-95275: Incorrect reference resolution in MediaStream.
• [543464436] Medium CVE-2026-95374: Incorrect authorization in Network.
• [545449081] Medium CVE-2026-95300: Missing authorization in DevTools.
• [545879261] Medium CVE-2026-95321: UI misrepresentation in Payments.
• [546438368] Medium CVE-2026-95323: UI misrepresentation in Chromium.
• [546639650] Medium CVE-2026-95332: Use of uninitialized variable in Tint.
• [547832510] Medium CVE-2026-95312: Information leak in Passwords.
• [548611433] Medium CVE-2026-95344: Race condition in DevTools.
• [549911100] Medium CVE-2026-95289: Incorrect authorization in Scroll.
• [550181232] Medium CVE-2026-95347: Use after free in Updater.
• [553123003] Medium CVE-2026-95311: Free of non-heap memory in Fonts.
• [553141660] Medium CVE-2026-95358: Incorrect authorization in Mobile.
• [559682346] Medium CVE-2026-95333: Use after free in Metrics.
• [423956129] Low CVE-2026-95307: UI misrepresentation in ExtensionsMenu.
• [497094708] Low CVE-2026-95285: Missing authorization in WebView.
• [497344014] Low CVE-2026-95278: Missing authorization in WakeLock.
• [502077689] Low CVE-2026-95327: Information leak in Networking.
• [513403696] Low CVE-2026-95334: Incorrect reference resolution in WebProtect.
• [513714849] Low CVE-2026-95308: Integer overflow in Metrics.
• [513781838] Low CVE-2026-95292: Incorrect authorization in Safebrowsing.
• [513791872] Low CVE-2026-95352: Incorrect authorization in DevTools.
• [514012689] Low CVE-2026-95279: UI misrepresentation in Omnibox.
• [514524620] Low CVE-2026-95367: Information leak in DataTransfer.
• [517192965] Low CVE-2026-95385: Inappropriate implementation in PlatformIntegration.
• [522413520] Low CVE-2026-95368: Incorrect authorization in DevTools.
• [523765972] Low CVE-2026-95319: Use after free in Printing.
• [533041383] Low CVE-2026-95326: Incomplete cleanup in Bluetooth.
• [533074595] Low CVE-2026-95309: UI misrepresentation in Mobile.
• [533095855] Low CVE-2026-95361: Confused deputy in DevTools.
• [533102653] Low CVE-2026-95288: UI misrepresentation in Mobile.
• [534579660] Low CVE-2026-95380: Type confusion in V8.
• [547027738] Low CVE-2026-95342: Missing authorization in V8.
• [551296612] Low CVE-2026-95296: Missing authorization in Core.
• [552023752] Low CVE-2026-95316: Unchecked return value in Performance.
• [553148673] Low CVE-2026-95328: Confused deputy in Mobile.
• [553268567] Low CVE-2026-95340: Incorrect authorization in PictureInPicture.
• [553271219] Low CVE-2026-95364: Improper input validation in Passwords.
• [553921181] Low CVE-2026-95305: UI misrepresentation in Chromoting.

YAML-Syck project reports:

YAML-Syck 1.47 fix the following issues:

• CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
• CVE-2026-57076 (CWE-416): use-after-free of an anchor key string shared between the node and the anchors table
• CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
• CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

Authen-SASL project reports:

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

The Rauthy project reports:

WebAuthn authentication code is not bound to the user. (GHSA-x8jp-v2j6-6vjf)

Refresh-token grant accepts a caller-supplied client without verifyinG it matches the token's `azp`, allowing cross-client token minting and identity/scope confusion. (https://github.com/sebadob/rauthy/security/advisories/GHSA-7qh2-3hc5-2vqp)

Unauthenticated remote panic aborts the whole process on two token endpoints (short refresh_token / device_code). (GHSA-wx92-7mmw-5x82)

The RusTLS project reports:

TLS 1.3 handshake message processing could allow a broken peer to send plaintext handshake messages where an encrypted one is expected without rustls rejecting the connection

DBI project reports:

DBI 1.650, 1.651, 1.652, 1.653 and 1.654 fix the following issues:

• CVE-2026-88815: Fix DBI::sql_type_cast on IV/NV
• CVE-2026-88816: Fix FetchHashKeyName on IV/NV
• CVE-2026-78030: Fix arbitrary module and file loading via dbm_type/dbm_mldbm
• CVE-2026-15392: Tighten symlink outside of f_dir
• CVE-2026-73194: Force placeholder limit on :# and :p# too
• CVE-2026-73193: Limit statements to 292 Mb in preparse
• CVE-2026-15043: Fix inverted comparisons for strings in DBI::SQL::Nano
• CVE-2026-15392: Fix DBD::File to ensure that the table is not a symlink outside of f_dir
• CVE-2026-60082: Fix an out-of-bounds error when a statement handle has no fields but the source row is not empty
• CVE-2026-60081: Add an overridable upper bound $MAX_PATH_DEPTH for DBI::ProfileData
• CVE-2026-14739: Set a hard limit of 99999 on '?' placeholders
• CVE-2026-14740: Fix out-of-bounds read in preparse of SQL that starts with a comment
• CVE-2026-14380: Fix code injection via Profile DSN attribute or DBI_PROFILE variable

The Erlang/OTP project reports:

OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix the following issues:

• CVE-2026-89422: TLS 1.3 client skips server authentication on unsolicited PSK. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate.
• CVE-2026-68956: SSH session channel exhaustion. The max_channels daemon option only limited channels with an active handler, so an authenticated client could open unlimited idle session channels and exhaust the memory of the whole Erlang VM.
• CVE-2026-65634: Superlinear CPU denial-of-service in the asn1 OID decoder via large base-128 arcs.

ExifTool versions up to 13.53 contain a code injection flaw in the Process_mrld function of lib/Image/ExifTool/GM.pm, reached while parsing JPEG, QuickTime, MOV and MP4 files. When exiftool is invoked with the -ee (extract embedded) option on a crafted file, a local attacker with low privileges can inject code that runs in the Perl runtime context of the exiftool process.

The issue is fixed in ExifTool 13.54.

The Podman developers report:

This release addresses (CVE-2025-11395), where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host.

This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do not believe these CVEs are exploitable through the Podman command line.

Gitlab reports:

Double Free issue in Regular Expression Parser impacts GitLab CE/EE

Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE

Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE

Missing Authorization issue in Duo AI job troubleshooting feature impacts GitLab EE

Incorrect Authorization issue in MCP API scope enforcement impacts GitLab CE/EE

Use of Less Trusted Source issue in Direct Transfer import user mapping impacts GitLab CE/EE

Missing Authorization issue in Epic Issues REST API impacts GitLab CE/EE

Incorrect Authorization issue in Duo Workflow Service token governance enforcement impacts GitLab EE

Improper Access Control issue in GraphQL memberRoles dependentSecurityPolicies resolver impacts GitLab EE

Missing Authorization issue in GraphQL CI job trace API impacts GitLab CE/EE

Race Condition issue in MCP gitlab_search tool impacts GitLab CE/EE

https://access.redhat.com/errata/RHSA-2026:56984 reports:

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

https://access.redhat.com/errata/RHSA-2026:56984 reports:

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).

Dancer project reports:

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

Dancer project reports:

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app. hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.

Mailpit author reports:

The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 ("Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4) bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PNG whose per-frame dimensions sit just under the limit still expands to a multiple of it. A remote, unauthenticated client can deliver such an attachment over SMTP and then request one thumbnail to force a multi-gigabyte native allocation.

The Angie Software Team reports:

When using an OpenSSL version without native HTTP/3 support (3.5.0 or earlier), if the default server for the address that accepted a regular HTTPS request also used HTTP/3 (the listen directive with the quic parameter, possibly on a different port), while a server block without HTTP/3 was selected by domain name (SNI), limited worker process memory corruption or a worker process crash could occur (CVE-2026-90439); the fix was ported from nginx 1.31.6.

The njs development team reports:

Access control bypass in js_access when an asynchronous request body continuation threw an exception or produced an unhandled rejection (CVE-2026-18329). Previously, nginx could continue processing the request as though the js_access check had succeeded. Affects 0.9.9-1.0.0.

Worker process crash when reading Response.statusText after an upstream server returned a status line with an empty reason phrase (CVE-2026-78222). Affects 0.5.1-1.0.0.

Heap buffer overflow while parsing namespace prefix lists passed to xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0.

Vinyl Development Team reports:

A workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.

This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart.

Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, ..etc).

The 389 Directory Server project reports:

CVE-2026-11770: the replication extended operations did not verify that the bind DN is accepted by the replica, and the CleanRUV status filters were open to LDAP injection.

CVE-2026-18355: a missing minimum length check in sasl_io_start_packet() lets an authenticated SASL user trigger an unsigned integer underflow, causing heap corruption and a crash of the server.

CVE-2026-18453: op_shared_search() does not check for a NULL backend pointer when reusing a paged results slot, so an unauthenticated client can crash ns-slapd with two search requests on one connection. Paged results and anonymous access are enabled by default.

CVE-2026-18922: a failed one-shot SASL exchange leaves stale identity data in the auxprop context, so a later successful bind on the same connection can inherit it and escalate to Directory Manager.

CVE-2026-19843: the cockpit LDAP editor passed the entry DN into a shell command line, so a user who can create or rename an entry can have the host run commands as root when an administrator opens that entry.

CVE-2026-76560: anonymous clients could satisfy SELFDN, USERDNATTR and LDAPURL ACL bind rules, granting unauthorized access.

The traefik project releases a new version addressing multiple vulnerabilities:

• GHSA-qqjf-53cj-pwvv (HTTP/3 Backend NTLM Connection Reuse)
• GHSA-f52w-8j3h-j724 (bypassing path-scoped routing)
• GHSA-v67p-phpq-fc8x (entrypoint header-name sanitization bypass)
• GHSA-w4v4-9rw7-5326 (HTTP Request/Response Smuggling)
• GHSA-8fcf-v89g-xpg6 (unauthenticated username-enumeration timing oracle)

Moritz Bunkus reports:

potential heap overflows/invalid memory access in the ODML index handling due to unsiged integer multiplication wrapping around (colloquially known as "overflowing") with specifically crafted AVI files. Affects only mkvmerge as the other tools do not read AVIs

NLnet Labs reports:

This release consolidates security fixes for issues reported over a period of time. There are fixes for:

• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY.
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization.
• CVE-2026-82717: CNAME synthesis could lead to heap corruption.
• CVE-2026-77955: Possible ZONEMD verification bypass window.
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission.
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection.
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path.
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC.
• CVE-2026-77860: ‘serve-expired’ can bypass Unbound ‘wait-limit’.

The nginx development team reports:

Buffer overflow when using ngx_http_v3_module (CVE-2026-90439). Severity: medium.

A heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier.

Abdo Hasani reports:

Imported note HTML may execute inside an embedded image-occlusion document that retains the editor profile's desktop API credentials. This could cross the boundary between untrusted note content and privileged desktop operations.

An improper path validation vulnerability allows an attacker to execute arbitrary code on a victim's system when they interact with a malicious flashcard deck. This vulnerability is triggered when a user right-clicks an image within the editor and selects the "Open image" action; if an embedded "<img>" tag contains a path with a dangerous extension in its src attribute, the operating system may execute the file.

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports:

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports:

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the length of the attacker-supplied `encrypted_key` (JWE Encrypted Key) before unwrapping it into a fixed-size, heap-allocated Content Encryption Key (CEK) buffer. A remote, unauthenticated attacker who can submit a crafted JWE to an application that decrypts it with an AES-KW symmetric key can trigger an out-of-bounds heap write, corrupting the heap. This leads at minimum to a crash (denial of service) and, depending on the heap layout and allocator, may be leverageable for further memory-corruption impact. `cjose_jwe_import()` / `cjose_jwe_decrypt()` are pre-authentication entry points: they parse and process fully attacker-controlled input. Upgrade to cjose 0.6.2.5 to receive a patch. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (`A128KW`/`A192KW`/`A256KW`) for untrusted JWEs at the application layer.

Gitea reports:

This release contains fixes for 26 security issues, hardens issue searching that an unfiltered query no longer enumerates every public repository into the indexer filter and removes unsafe code from the internal private endpoints. Please upgrade as soon as possible.

The strongSwan project reports:

strongSwan 6.1.0 fixes eleven vulnerabilities:

• CVE-2026-78123: A flaw in the openssl plugin in the processing of PKCS#7 containers can result in a crash. Affects 5.0.2 and newer.
• CVE-2026-78124: A flaw in the openssl plugin in the enumeration of certificates in PKCS#7 containers can result in memory leaks. Affects 5.0.2 and newer.
• CVE-2026-78126: A flaw in the eap-aka plugin in the processing of an unexpected AKA-Synchronization-Failure can result in a crash. Affects 4.1.10 and newer.
• CVE-2026-78127: A flaw in libcharon in the logging of IKE messages can result in a denial of service via memory exhaustion. Affects 4.1.2 and newer.
• CVE-2026-78129: A flaw in libstrongswan in the processing of encrypted PKCS#7 containers can result in a denial of service. Affects 4.6.2 and newer.
• CVE-2026-78130: A flaw in the x509 plugin in the verification of X.509 attribute certificates can lead to a denial of service. Affects 4.2.0 and newer.
• CVE-2026-78131: A flaw in the x509 plugin in the parsing of identities in X.509 attribute certificates can lead to a denial of service via memory exhaustion. Affects 4.2.0 and newer.
• CVE-2026-78132: A flaw in the x509 plugin in the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates can lead to a denial of service. Affects 5.1.3 and newer.
• CVE-2026-78133: A flaw in libcharon in the handling of IKEv2 rekeying collisions can result in a use-after-free and potentially remote code execution. Affects 6.0.0 and newer.
• CVE-2026-78134: A flaw in the eap-peap and eap-ttls plugins in the propagation of authentication details from inner EAP methods can result in incorrect identity binding and potential authorization bypass. Affects 4.5.0 and newer.
• CVE-2026-78135: A flaw in libcharon in the handling of CREATE_CHILD_SA requests on unestablished IKE SAs can result in the creation of a usable Child SA before authentication completes. Affects 5.9.7 and newer.

ZNC reports:

CVE-2026-82373: Use-after-free when unloading modules, triggered by unprivileged users. To mitigate, set DenyLoadMod to true.

CVE-2026-82374: Null pointer dereference in crypt module, triggered by IRC server.

CVE-2020-11022, CVE-2020-11023: Updated the old bundled vulnerable version of jQuery to 3.5.1.

Gitlab reports:

Path Traversal issue in repository commits API impacts GitLab CE/EE

Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE

Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE

Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables

Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE

Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE

Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE

Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE

Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE

Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE

Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE

Cross-site Scripting issue in Content Editor impacts GitLab CE/EE

Access Control Implementation issue in protected environment approval rules impacts GitLab EE

Authorization Bypass issue in protected environment approval rules impacts GitLab EE

Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE

Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE

Missing Authorization issue in Compliance Framework management impacts GitLab EE

Improper Input Validation issue in Terraform State API impacts GitLab CE/EE

https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports:

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

VulnCheck reports:

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links.

In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk endpoint performs, and the album and shared link access checks still carry no visibility filter. Both code paths of the web interface use the bulk endpoint, so the state can only be reached by calling the API directly, and such assets stay visible only to those the owner already shares the album or the link with. The identifier was assigned by VulnCheck, not by the immich project, which has published no advisory and has not confirmed the report. NVD has not analysed the entry.

The immich project reports:

The /maintenance endpoint fails to validate the continue URL parameter. When maintenance mode is disabled, which is the default, the application accepts unvalidated redirect targets, enabling both open redirects and reflected cross-site scripting. An unauthenticated user can craft a malicious link leading to account takeover, including administrative accounts, through same-origin API requests with credentials.

amqp091-go developers report:

Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints.

Redpanda Connect vendored an affected amqp091-go release up to version 4.108.0; 4.109.0 bumps it to 1.14.0.

The FreeIPA project reports:

• CVE-2026-76578: the access control instruction for self-managed OTP tokens requires no authentication and does not restrict which attributes may be written alongside the token entry. An unauthenticated LDAP client can create a Kerberos principal and add it to the administrators group.
• CVE-2026-79678: insufficiently validated --organization and --base-url input to idp-add reaches a constrained eval() before the LDAP access control check is enforced, allowing any authenticated principal to enumerate server environment variables and to exhaust memory.
• CVE-2026-11861: where a cross-realm trust with Active Directory is configured, Active Directory users can bypass authentication for FreeIPA services including the Web UI, the SMB server and the LDAP directory.
• CVE-2026-13097: the uniqueness constraint on Kerberos principal name attributes does not account for equivalent representations of the same name, so a user with LDAP write privileges can create a service principal that impersonates a privileged one.
• CVE-2026-19550: trust-fetch-domains is gated by a read-only permission on the trust object rather than a trust administration permission, letting any authenticated user trigger a privileged trust refresh against an attacker-supplied server.
• CVE-2026-73196: an oversized OTP key value is decoded and re-encoded without a size limit, consuming excessive CPU and memory.
• CVE-2026-73197: the migration endpoint reads oversized POST bodies fully into memory, which an unauthenticated client can abuse for denial of service.
• CVE-2026-73198: the i18n_messages endpoint accepts arbitrarily large request bodies, which an unauthenticated client can abuse for memory exhaustion.
• CVE-2026-73199: a null pointer dereference in the ipa-enrollment SLAPI plugin crashes the directory server when a malformed LDAP extended operation omits a required request value.

The CrowdSec Team reports:

• [GHSA-g2x2-jgfg-pg7g]: HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length.
• [GHSA-rh69-4vqj-9gj8]: Unbounded request-body read in kubernetes-audit acquisition webhook.

The Roundcube project reports:

• CSS declaration smuggling via un-encoded ampersand emission
• CSS property injection via body background attribute
• email header injection via bare CR in the subject field
• email header injection via C-escape \r in the recipient display name
• email header injection via identity’s organization field
• zero-click stored XSS via TNEF MIME tag injection in the attachment URL
• XSS in the HTML editor using text/enriched part content
• cross-user access in contact group membership (add/remove) in the SQL address book
• is_local_url() bypass via trailing-dot FQDN in stylesheet URL
• remote content blocking bypass via CSS escapes in FuncIRI attributes
• remote-content blocker bypass via SVG SMIL src animation
• SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

OpenVPN team reports:

OpenVPN 2.x allows attackers to potentially cause a denial of service against the control channel reliability layer, either by driving the reliable TLS retransmission timeout to grow without bound, or by sending acknowledgements for packets that cannot be outstanding.

F5 reports:

A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when xml.exclusiveC14n() processes a crafted XML namespace prefix list. This may lead to worker process crashes, heap corruption or memory disclosure. The NGINX SAML reference implementation is affected because it processes SAML data before signature verification.

Electron developers report:

This update fixes the following vulnerabilities: CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776, CVE-2026-15777, and CVE-2026-15778.

Jenkins Security Advisory 2026-09-02:

• (High) SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability
• (Medium) SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization
• (High) SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration
• (High) SECURITY-3967 / CVE-2026-84648: Stored XSS vulnerability in system log viewer
• (High) SECURITY-3878 / CVE-2026-84649: Cross-origin exposure of CSRF token
• (High) SECURITY-4032 / CVE-2026-84650: Unsafe deserialization allows overwriting configuration
• (Medium) SECURITY-4025 / CVE-2026-84651: Unsafe deserialization allows overwriting other agents
• (High) SECURITY-4016 / CVE-2026-84652: Session fixation vulnerability
• (Medium) SECURITY-3981 / CVE-2026-84653: Incorrect permission check in Appearance configuration page
• (Medium) SECURITY-3926 / CVE-2026-84654: Form submission data binding can set static fields
• (Medium) SECURITY-3879 / CVE-2026-84655: Injection vulnerability in REST API
• (Medium) SECURITY-4006 / CVE-2026-84656: Missing permission check allows reading build parameters
• (Medium) SECURITY-4015 / CVE-2026-84657: Missing permission check allows canceling builds

Patrick Arminio reports:

"PermissionExtension.resolve()" evaluates the return value of "has_permission()" for truthiness on the synchronous path. "supports_sync" only classifies a permission as asynchronous when "has_permission" is declared with "async def" (via "inspect.iscoroutinefunction"), so a plain "def" that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to "False" and the protected resolver runs. The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both "execute_sync()" and "execute()". Permissions declared with "async def has_permission()", or a plain "def" returning a boolean, are not affected.

Chrome Releases reports:

This update includes 26 security fixes:

• [522307103] Critical CVE-2026-84353: Use after free in Shared Tab Groups.
• [546260492] Critical CVE-2026-84352: Use after free in WebGL.
• [498839176] High CVE-2026-84354: Incorrect authorization in FileSystem.
• [514078656] High CVE-2026-84359: Information leak in Skia.
• [523208474] High CVE-2026-84357: Improper input validation in Omnibox.
• [533534913] High CVE-2026-84324: Use after free in Proxy.
• [537105664] High CVE-2026-84349: Use after free in Browser.
• [547936520] High CVE-2026-84326: Uninitialized resource in V8.
• [549311485] High CVE-2026-84333: Use after free in Dawn.
• [551593376] High CVE-2026-84351: Buffer overflow in GPU.
• [553117928] High CVE-2026-84325: Improper input validation in DataTransfer.
• [498710886] Medium CVE-2026-84328: Missing authorization in FileSystem.
• [501679156] Medium CVE-2026-84347: Use after free in WebRTC.
• [502411391] Medium CVE-2026-84323: Missing authorization in FileSystem.
• [511774376] Medium CVE-2026-84355: Incorrect authorization in Navigation.
• [514006886] Medium CVE-2026-84358: Improper privilege management in Downloads.
• [514489238] Medium CVE-2026-84332: Incorrect authorization in SiteSettings.
• [517091927] Medium CVE-2026-84330: UI misrepresentation in FullScreen.
• [517798926] Medium CVE-2026-84334: Incorrect authorization in Chromoting.
• [518100026] Medium CVE-2026-84348: Information leak in MediaCapture.
• [522302504] Medium CVE-2026-84335: Incorrect authorization in TabStrip.
• [498725213] Low CVE-2026-84327: Incorrect authorization in Autofill.
• [498850269] Low CVE-2026-84329: Confused deputy in CredentialProvider.
• [503787232] Low CVE-2026-84356: UI misrepresentation in FullScreen.
• [513713427] Low CVE-2026-84350: Use after free in TabStrip.
• [521753402] Low CVE-2026-84331: Incorrect authorization in Actor.

https://github.com/libexpat/libexpat/pull/1331 reports:

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

https://github.com/libexpat/libexpat/pull/1321 reports:

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

The Erlang/OTP project reports:

OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations:

• CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation.
• CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer Conversion.
• CVE-2026-66357: HTTP Request Smuggling via obs-fold Header Continuation in httpd.
• CVE-2026-66835: Possible directory protection bypass in Erlang-OTP inets httpd.
• CVE-2026-69664: Denial of Service via Malformed Chunk Size in httpd.
• CVE-2026-70399: Denial of Service via Unenforced Default max_clients Limit in httpd.
• CVE-2026-70405: snmp: Denial-of-Service enabled by Unbounded Integer Conversion.
• CVE-2026-70409: eldap: Denial-of-Service enabled by Unbounded Integer Conversion.
• CVE-2026-71380: Denial of Service via Body-Read Timeout Gap in httpd (Slowloris Variant).
• CVE-2026-71562: inets: Denial-of-Service enabled by Unbounded Integer Conversion.
• CVE-2026-73270: Authentication Bypass via Case-Insensitive Filesystem Path Matching in httpd mod_auth.
• CVE-2026-73276: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping in httpd.
• CVE-2026-73812: HTTP Request Smuggling via Transfer-Encoding and Content-Length in httpd.
• CVE-2026-74835: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception in httpd.
• CVE-2026-74994: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (dets/mnesia backends).

The OTP 29.0.6 release notes report:

A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

Chrome Releases reports:

This update includes 327 security fixes:

• [496807874] Critical CVE-2026-79282: Use after free in ANGLE.
• [516427761] Critical CVE-2026-79290: Use after free in Aura.
• [516764384] Critical CVE-2026-79054: Use after free in Chromecast.
• [516777082] Critical CVE-2026-79121: Improper input validation in Chromecast.
• [516988476] Critical CVE-2026-79224: Use after free in Chromecast.
• [517518019] Critical CVE-2026-79052: Use after free in Aura.
• [518006007] Critical CVE-2026-79150: Use after free in Views.
• [522082472] Critical CVE-2026-78935: Use of uninitialized variable in Mobile.
• [523704817] Critical CVE-2026-79012: Use after free in Safebrowsing.
• [532921800] Critical CVE-2026-79200: Use after free in Aura.
• [532617619] High CVE-2026-78989: Out of bounds read in ANGLE.
• [508638064] High CVE-2026-79069: Memory corruption in Tint.
• [498885920] High CVE-2026-79175: Type confusion in Accessibility.
• [500311587] High CVE-2026-79218: Incorrect authorization in Sandbox.
• [501892500] High CVE-2026-79195: Use after free in Script.
• [513261751] High CVE-2026-78939: Use after free in Chromecast.
• [515470739] High CVE-2026-79194: Use after free in Chromoting.
• [515473074] High CVE-2026-79247: Use after free in Chromoting.
• [516947491] High CVE-2026-79219: Use after free in Bluetooth.
• [517515945] High CVE-2026-79047: Use after free in Views.
• [517519352] High CVE-2026-79292: Integer overflow in Chromecast.
• [517527943] High CVE-2026-78986: Uninitialized resource in GPU.
• [517548647] High CVE-2026-79039: Use after free in Mobile.
• [517550232] High CVE-2026-78934: Race condition in ReadAloud.
• [517736936] High CVE-2026-79011: UI misrepresentation in Browser.
• [517742721] High CVE-2026-78911: Incorrect authorization in USB.
• [517959443] High CVE-2026-79257: Use after free in Views.
• [521285077] High CVE-2026-79202: Use after free in Chromecast.
• [521502218] High CVE-2026-79212: Missing authorization in Passwords.
• [521942358] High CVE-2026-79183: Use after free in Accessibility.
• [522294538] High CVE-2026-79155: Race condition in FileSystem.
• [523095011] High CVE-2026-79093: Incorrect authorization in Paint.
• [523266585] High CVE-2026-79019: Out of bounds write in ANGLE.
• [523296105] High CVE-2026-79187: Use after free in WebRTC.
• [523714535] High CVE-2026-79288: Improper input validation in Autofill.
• [523717796] High CVE-2026-79130: Buffer overflow in ANGLE.
• [523723064] High CVE-2026-78965: Uninitialized resource in ANGLE.
• [523738212] High CVE-2026-79117: Race condition in WebAppInstalls.
• [524698525] High CVE-2026-79082: Incorrect authorization in Transactions Platform.
• [525683797] High CVE-2026-79111: Improper input validation in Dawn.
• [528397177] High CVE-2026-79072: Improper state validation in Performance.
• [529509587] High CVE-2026-79142: Buffer overflow in ANGLE.
• [529991907] High CVE-2026-78948: Buffer overflow in WebGL.
• [532904047] High CVE-2026-78908: Information leak in Canvas.
• [532914190] High CVE-2026-78895: Information leak in Paint.
• [532988552] High CVE-2026-79043: Out of bounds write in ANGLE.
• [534468209] High CVE-2026-79235: Use after free in WebGL.
• [534591074] High CVE-2026-79232: Use after free in Aura.
• [535379043] High CVE-2026-79118: Uninitialized resource in ANGLE.
• [535876894] High CVE-2026-79174: Incorrect authorization in Extensions.
• [536428615] High CVE-2026-78900: Improper input validation in Media.
• [536444272] High CVE-2026-79188: Out of bounds write in ANGLE.
• [536505721] High CVE-2026-79189: Out of bounds write in ANGLE.
• [536531630] High CVE-2026-79048: Out of bounds write in ANGLE.
• [536532605] High CVE-2026-79240: Out of bounds write in ANGLE.
• [536568319] High CVE-2026-79014: Race condition in Autofill.
• [536606137] High CVE-2026-79198: Use after free in Platform.
• [536626343] High CVE-2026-79131: Out of bounds write in ANGLE.
• [536636648] High CVE-2026-79149: Use after free in ANGLE.
• [536659904] High CVE-2026-79275: Use after free in ANGLE.
• [536681676] High CVE-2026-79138: Out of bounds write in ANGLE.
• [537109028] High CVE-2026-79026: Use after free in Extensions.
• [537233963] High CVE-2026-79027: Use after free in WebRTC.
• [537835609] High CVE-2026-78904: Type confusion in ANGLE.
• [540430406] High CVE-2026-78899: Use after free in V8.
• [540870921] High CVE-2026-78954: Incorrect authorization in Extensions.
• [543707066] High CVE-2026-79274: Information leak in GPU.
• [545767601] High CVE-2026-78938: Type confusion in V8.
• [545820931] High CVE-2026-78952: Out of bounds write in Crashpad.
• [546670199] High CVE-2026-79236: Type confusion in V8.
• [548340637] High CVE-2026-79078: Use after free in FedCM.
• [495021566] Medium CVE-2026-79209: Type confusion in Animation.
• [40057398] Medium CVE-2026-79030: Observable discrepancy in Autofill.
• [536913431] Medium CVE-2026-79216: Buffer overflow in Blink.
• [495579602] Medium CVE-2026-79007: Uninitialized resource in GPU.
• [495998981] Medium CVE-2026-78893: Information leak in QUIC.
• [496195129] Medium CVE-2026-79222: Incorrect authorization in CustomTabs.
• [496292729] Medium CVE-2026-79071: Race condition in GPU.
• [496395158] Medium CVE-2026-79076: Improper input validation in Sync.
• [496401361] Medium CVE-2026-79088: Incorrect authorization in FileSystem.
• [497017869] Medium CVE-2026-79104: Missing authorization in Sensor.
• [497095313] Medium CVE-2026-79044: Missing authorization in WebAppInstalls.
• [497205529] Medium CVE-2026-78958: Uninitialized resource in Skia.
• [497269030] Medium CVE-2026-78961: Incorrect authorization in Core.
• [497338168] Medium CVE-2026-79262: Incorrect authorization in Network.
• [497456156] Medium CVE-2026-79106: Improper input validation in Input.
• [497538341] Medium CVE-2026-79176: UI misrepresentation in Extensions.
• [497637694] Medium CVE-2026-78966: Externally controlled reference in QUIC.
• [497646947] Medium CVE-2026-79186: Incorrect authorization in Network.
• [497839983] Medium CVE-2026-79267: Race condition in Workers.
• [497854976] Medium CVE-2026-79016: Observable discrepancy in SVG.
• [497869284] Medium CVE-2026-79010: Operation on a resource after expiration or release in Network.
• [497940451] Medium CVE-2026-79286: Missing authorization in CustomTabs.
• [497948894] Medium CVE-2026-78945: Use after free in Views.
• [497957278] Medium CVE-2026-78999: Improper privilege management in Navigation.
• [498327743] Medium CVE-2026-78941: Information leak in Core.
• [498328139] Medium CVE-2026-79032: Improper input validation in Network.
• [498367544] Medium CVE-2026-79109: Improper input validation in Printing.
• [499007248] Medium CVE-2026-79256: Externally controlled reference in WebView.
• [499068536] Medium CVE-2026-79237: Incorrect authorization in Navigation.
• [499423269] Medium CVE-2026-78898: Incorrect authorization in Downloads.
• [500038021] Medium CVE-2026-78985: Incorrect reference resolution in FileSystem.
• [500492844] Medium CVE-2026-79028: Observable discrepancy in Network.
• [501331457] Medium CVE-2026-79210: Use after free in Audio.
• [501437087] Medium CVE-2026-79046: Race condition in Permissions.
• [501572758] Medium CVE-2026-79129: Use after free in Sessions.
• [501590191] Medium CVE-2026-78937: Use after free in Search.
• [501594511] Medium CVE-2026-78987: Information leak in Canvas.
• [501604761] Medium CVE-2026-78990: Use after free in Compositing.
• [501637242] Medium CVE-2026-78909: Use after free in Views.
• [501661601] Medium CVE-2026-79271: Information leak in DOM.
• [501759192] Medium CVE-2026-79144: Information leak in Skia.
• [501799770] Medium CVE-2026-79065: Improper input validation in Network.
• [502082953] Medium CVE-2026-79192: Improper input validation in Variations.
• [502101200] Medium CVE-2026-79140: Use after free in Views.
• [502109333] Medium CVE-2026-79128: Use after free in Views.
• [502139081] Medium CVE-2026-78942: Incorrect reference resolution in Loader.
• [502232151] Medium CVE-2026-79116: Missing authorization in Viz.
• [502344135] Medium CVE-2026-79006: Protection mechanism failure in HttpsUpgrades.
• [502488051] Medium CVE-2026-79095: Information leak in Payments.
• [502805441] Medium CVE-2026-79084: Inadequate encryption strength in Notifications.
• [502888857] Medium CVE-2026-78991: Race condition in WebProtect.
• [502918844] Medium CVE-2026-79248: Incorrect authorization in Input.
• [503013378] Medium CVE-2026-78891: Buffer overflow in WebRTC.
• [503472696] Medium CVE-2026-79031: Improper resource exposure in Preload.
• [503585863] Medium CVE-2026-79110: Missing authorization in Preload.
• [503624894] Medium CVE-2026-79136: Incorrect authorization in ServiceWorker.
• [503847023] Medium CVE-2026-78907: Incorrect authorization in WebProtect.
• [504226770] Medium CVE-2026-79087: Injection in Chrome Tabs.
• [504356442] Medium CVE-2026-79231: Buffer overflow in Media.
• [504633668] Medium CVE-2026-78969: Uninitialized resource in Video.
• [505951430] Medium CVE-2026-79137: Incorrect authorization in Extensions.
• [505967344] Medium CVE-2026-79057: Race condition in Start.
• [505991181] Medium CVE-2026-78894: Race condition in Payments.
• [507483993] Medium CVE-2026-79264: Incorrect reference resolution in Preload.
• [511260796] Medium CVE-2026-78910: Buffer overflow in V8.
• [511736672] Medium CVE-2026-79066: Improper input validation in Navigation.
• [511794959] Medium CVE-2026-79255: Improper input validation in WebRTC.
• [511804361] Medium CVE-2026-79086: Missing authorization in CustomTabs.
• [511806043] Medium CVE-2026-79038: Incorrect authorization in WebProtect.
• [511819962] Medium CVE-2026-78940: Improper initialization in Network.
• [511822878] Medium CVE-2026-79107: Incorrect authorization in TabGroups.
• [512971896] Medium CVE-2026-79120: Uninitialized resource in ANGLE.
• [513048462] Medium CVE-2026-79270: Uninitialized resource in ANGLE.
• [513049445] Medium CVE-2026-79067: Missing authorization in Network.
• [513119757] Medium CVE-2026-79213: Incorrect authorization in WebAppInstalls.
• [513192145] Medium CVE-2026-78943: Improper input validation in Editing.
• [513222422] Medium CVE-2026-79259: Improper input validation in Safebrowsing.
• [513287677] Medium CVE-2026-79208: Missing authorization in HTTP2.
• [513392351] Medium CVE-2026-79251: Improper input validation in Network.
• [513607252] Medium CVE-2026-79226: Improper privilege management in Regional Capabilities.
• [513608317] Medium CVE-2026-79042: Missing authorization in Payments.
• [513608831] Medium CVE-2026-79122: Information leak in SignIn.
• [513719741] Medium CVE-2026-79199: Incorrect authorization in Network.
• [513737209] Medium CVE-2026-79013: Improper input validation in Sync.
• [513745793] Medium CVE-2026-79074: Information leak in Network.
• [513760788] Medium CVE-2026-79215: Integer overflow in WebGL.
• [513786555] Medium CVE-2026-79049: Incorrect reference resolution in Passwords.
• [513834155] Medium CVE-2026-79132: Improper input validation in Input.
• [513836495] Medium CVE-2026-79201: Improper access control in Workers.
• [513841856] Medium CVE-2026-79051: Incorrect authorization in Loader.
• [513850062] Medium CVE-2026-79053: Missing authorization in Lighthouse.
• [513918923] Medium CVE-2026-79285: Uninitialized resource in ANGLE.
• [513923164] Medium CVE-2026-78906: Race condition in ANGLE.
• [514006744] Medium CVE-2026-79250: UI misrepresentation in Navigation.
• [514017820] Medium CVE-2026-79020: Out of bounds read in Skia.
• [514055709] Medium CVE-2026-79217: Incorrect authorization in Mobile.
• [514069975] Medium CVE-2026-79204: UI misrepresentation in Input.
• [514078852] Medium CVE-2026-78912: UI misrepresentation in Browser.
• [514439436] Medium CVE-2026-78955: Observable discrepancy in PerformanceAPIs.
• [514454739] Medium CVE-2026-79143: Incorrect authorization in FileSystem.
• [514508415] Medium CVE-2026-79241: Out of bounds read in GPU.
• [514529599] Medium CVE-2026-78967: Missing authorization in BFCache.
• [515477007] Medium CVE-2026-79214: Improper input validation in Preload.
• [516398679] Medium CVE-2026-79228: Incorrect authorization in SiteIsolation.
• [516665605] Medium CVE-2026-78953: Missing authorization in SiteIsolation.
• [516824665] Medium CVE-2026-79229: Uninitialized resource in ANGLE.
• [516899248] Medium CVE-2026-79002: Incorrect authorization in SiteIsolation.
• [516921259] Medium CVE-2026-79272: Improper input validation in FindInPage.
• [517045394] Medium CVE-2026-79127: Out of bounds write in ANGLE.
• [517074167] Medium CVE-2026-79151: Improper input validation in Safebrowsing.
• [517095594] Medium CVE-2026-78936: Observable discrepancy in CustomTabs.
• [517245017] Medium CVE-2026-78905: Type confusion in ANGLE.
• [517364411] Medium CVE-2026-79050: Incorrect authorization in Network.
• [517382613] Medium CVE-2026-79008: Improper input validation in GPU.
• [517398863] Medium CVE-2026-78975: Incorrect authorization in DOM.
• [517404644] Medium CVE-2026-79287: Observable discrepancy in Forms.
• [517467117] Medium CVE-2026-79094: Race condition in Workers.
• [517487890] Medium CVE-2026-79173: UI misrepresentation in WebAppInstalls.
• [517550421] Medium CVE-2026-78976: Improper input validation in StorageAccessAPI.
• [517580738] Medium CVE-2026-79276: Improper privilege management in FileSystem.
• [517606780] Medium CVE-2026-79191: Incorrect authorization in SiteIsolation.
• [517608454] Medium CVE-2026-79099: Missing authorization in Network.
• [517634590] Medium CVE-2026-79024: Information leak in ServiceWorker.
• [517655953] Medium CVE-2026-79193: Information leak in Canvas.
• [517697155] Medium CVE-2026-79242: Observable discrepancy in HTML.
• [517719358] Medium CVE-2026-79180: UI misrepresentation in CustomTabs.
• [517746687] Medium CVE-2026-79293: Information leak in Animation.
• [517761566] Medium CVE-2026-79023: Incorrect authorization in Editing.
• [517772510] Medium CVE-2026-79146: Information leak in CustomTabs.
• [517774971] Medium CVE-2026-79238: Incorrect authorization in ServiceWorker.
• [517910756] Medium CVE-2026-78949: Observable discrepancy in CustomTabs.
• [518023156] Medium CVE-2026-79291: Information leak in CSS.
• [518035396] Medium CVE-2026-79283: UI misrepresentation in Geometry.
• [518053893] Medium CVE-2026-78892: Incorrect authorization in Chromoting.
• [518062961] Medium CVE-2026-79070: Incorrect reference resolution in Cache.
• [518065628] Medium CVE-2026-79205: Incorrect authorization in Network.
• [518078552] Medium CVE-2026-78903: Incomplete cleanup in SiteIsolation.
• [518084889] Medium CVE-2026-78959: Improper handling of case sensitivity in FileSystem.
• [518094442] Medium CVE-2026-79234: Injection in CSS.
• [519369088] Medium CVE-2026-78983: Use after free in Views.
• [519984038] Medium CVE-2026-79083: Improper enforcement of behavioral workflow in Media.
• [520052954] Medium CVE-2026-78944: Use after free in DevTools.
• [520117546] Medium CVE-2026-79178: Incorrect authorization in Web Authentication (Passkeys & Security Keys).
• [520121111] Medium CVE-2026-79059: Information leak in BFCache.
• [520179360] Medium CVE-2026-79245: Use after free in UI.
• [520464738] Medium CVE-2026-78978: Out of bounds read in ANGLE.
• [520481800] Medium CVE-2026-79103: Incorrect reference resolution in Speech.
• [520492291] Medium CVE-2026-79154: Missing authorization in DevTools.
• [520504922] Medium CVE-2026-79230: Improper input validation in ANGLE.
• [520516462] Medium CVE-2026-79068: Improper resource exposure in StreamsAPI.
• [520542088] Medium CVE-2026-79269: Uninitialized resource in ANGLE.
• [522077127] Medium CVE-2026-79085: Missing authorization in Network.
• [522351802] Medium CVE-2026-79134: Incorrect authorization in GetUserMedia.
• [522550059] Medium CVE-2026-79064: Use after free in Network.
• [522791354] Medium CVE-2026-79003: Incorrect authorization in Device.
• [522823211] Medium CVE-2026-79220: Information leak in Network.
• [522957054] Medium CVE-2026-78951: Use after free in ServiceWorker.
• [523232966] Medium CVE-2026-79249: Code injection in Bisection.
• [523557855] Medium CVE-2026-79091: Use after free in Bluetooth.
• [523661149] Medium CVE-2026-79265: Incomplete cleanup in GetUserMedia.
• [523716748] Medium CVE-2026-78913: Use after free in Chromoting.
• [524418836] Medium CVE-2026-79258: Incorrect authorization in WebXR.
• [524520965] Medium CVE-2026-79211: Incorrect authorization in USB.
• [524541667] Medium CVE-2026-79252: Information leak in ServiceWorker.
• [524822825] Medium CVE-2026-78962: Uninitialized resource in WebXR.
• [525686865] Medium CVE-2026-78901: Race condition in V8.
• [525689847] Medium CVE-2026-79097: Use after free in V8.
• [532162132] Medium CVE-2026-79227: Type confusion in DevTools.
• [532182486] Medium CVE-2026-79203: Improper input validation in DevTools.
• [532914769] Medium CVE-2026-79033: Insufficient control flow management in DevTools.
• [532917452] Medium CVE-2026-79139: Improper input validation in Media.
• [532923954] Medium CVE-2026-79221: Uninitialized resource in Dawn.
• [532957785] Medium CVE-2026-79034: Information leak in CORS.
• [533093250] Medium CVE-2026-79075: Information leak in Geolocation.
• [533917984] Medium CVE-2026-78960: Information leak in Extensions.
• [535374213] Medium CVE-2026-78984: Uninitialized resource in GPU.
• [536428842] Medium CVE-2026-78963: Improper input validation in Media.
• [536428988] Medium CVE-2026-79004: Out of bounds read in Media.
• [536444242] Medium CVE-2026-79182: Improper input validation in Media.
• [536526176] Medium CVE-2026-79185: Information leak in DOM.
• [536662911] Medium CVE-2026-79073: Improper state validation in Parser.
• [537145191] Medium CVE-2026-79266: Use after free in DevTools.
• [537846307] Medium CVE-2026-79025: Improper input validation in Workers.
• [538969297] Medium CVE-2026-79141: Incorrect authorization in Browser.
• [503048520] Low CVE-2026-78974: UI misrepresentation in Linux Toolkit Theming.
• [497232609] Low CVE-2026-79055: Information leak in Sharing.
• [497256260] Low CVE-2026-79263: Race condition in Extensions.
• [497493136] Low CVE-2026-79124: Information leak in Intents.
• [497499482] Low CVE-2026-79184: Missing authorization in Preload.
• [497876969] Low CVE-2026-79289: Improper control of a resource through its lifetime in Workers.
• [500484520] Low CVE-2026-79001: Information leak in Bluetooth.
• [501416859] Low CVE-2026-79077: Incorrect authorization in WebProtect.
• [501881082] Low CVE-2026-78950: Integer overflow in WebRTC.
• [502252964] Low CVE-2026-79196: Race condition in Editing.
• [502514083] Low CVE-2026-79000: Improper input validation in DeviceBoundSessionCredentials.
• [503720291] Low CVE-2026-78979: Race condition in Core.
• [506539337] Low CVE-2026-79181: Observable discrepancy in Glic.
• [513172858] Low CVE-2026-79190: Incorrect authorization in Extensions.
• [513361380] Low CVE-2026-79206: Out of bounds read in FileSystem.
• [513486883] Low CVE-2026-78897: Missing authorization in BrowserTag.
• [513688690] Low CVE-2026-79119: Use after free in PDF.
• [513792983] Low CVE-2026-79089: Race condition in Transactions Platform.
• [513969378] Low CVE-2026-79147: Information leak in Skia.
• [514010111] Low CVE-2026-79098: UI misrepresentation in PermissionElement.
• [514038302] Low CVE-2026-79022: UI misrepresentation in Transactions Platform.
• [514061923] Low CVE-2026-79233: UI misrepresentation in CustomTabs.
• [514408247] Low CVE-2026-79261: Incorrect authorization in Controls.
• [516864349] Low CVE-2026-78977: Uninitialized resource in GPU.
• [516950646] Low CVE-2026-79040: Uninitialized resource in GPU.
• [517167020] Low CVE-2026-79273: Incorrect reference resolution in WebView.
• [517394060] Low CVE-2026-79243: Improper input validation in ReadingList.
• [517395590] Low CVE-2026-79123: Improper input validation in NTP Footer.
• [517540292] Low CVE-2026-79005: Incorrect authorization in StorageAccessAPI.
• [517673944] Low CVE-2026-79090: Improper privilege management in Actor.
• [517718241] Low CVE-2026-78946: Incorrect authorization in Select.
• [518125889] Low CVE-2026-78968: Missing authorization in Core.
• [518249083] Low CVE-2026-79041: Missing authorization in Browser.
• [519210950] Low CVE-2026-79284: UI misrepresentation in Core.
• [519229463] Low CVE-2026-78896: Information leak in StorageAccessAPI.
• [519242511] Low CVE-2026-79058: Missing authorization in Passwords.
• [519246298] Low CVE-2026-79009: UI misrepresentation in UI.
• [519254827] Low CVE-2026-79060: Incorrect authorization in StorageAccessAPI.
• [520002854] Low CVE-2026-79177: Incorrect authorization in Media.
• [520016142] Low CVE-2026-78956: Type confusion in V8.
• [520781436] Low CVE-2026-79239: Out of bounds read in Tint.
• [522291712] Low CVE-2026-79015: Improper input validation in ServiceWorker.
• [522304549] Low CVE-2026-79108: UI misrepresentation in Web Authentication (Passkeys & Security Keys).
• [522418913] Low CVE-2026-79056: Use after free in ServiceWorker.
• [522803735] Low CVE-2026-79018: Information leak in FoldableAPIs.
• [523237735] Low CVE-2026-78980: Improper input validation in ReaderMode.
• [523313378] Low CVE-2026-78947: Incomplete cleanup in Chromium.
• [523572877] Low CVE-2026-79244: Use after free in Animation.
• [524864599] Low CVE-2026-79112: Out of bounds read in Skia.
• [525311654] Low CVE-2026-79246: Information leak in DataTransfer.
• [530816571] Low CVE-2026-79223: Integer overflow in Chromium.
• [531245718] Low CVE-2026-79045: Type confusion in V8.
• [531297707] Low CVE-2026-79197: Use after free in V8.
• [532303080] Low CVE-2026-79148: Off-by-one error in DevTools.
• [533001362] Low CVE-2026-79125: Information leak in XR.
• [533014006] Low CVE-2026-79207: Information leak in Passwords.
• [533021205] Low CVE-2026-79017: Race condition in Extensions.
• [533046298] Low CVE-2026-79105: Improper input validation in Mobile.
• [533059149] Low CVE-2026-79225: Incorrect authorization in Browser.
• [533060125] Low CVE-2026-79021: Missing authorization in InterestGroups.
• [533075126] Low CVE-2026-79133: Incorrect authorization in Forms.
• [533079345] Low CVE-2026-79179: Incorrect authorization in DOM.
• [533083384] Low CVE-2026-79152: Incorrect authorization in CustomTabs.
• [533121405] Low CVE-2026-78981: Information leak in Mobile.
• [533123348] Low CVE-2026-78957: Information leak in Mobile.
• [533408915] Low CVE-2026-79126: Incorrect provision of specified functionality in Proxy.
• [533418127] Low CVE-2026-78915: Race condition in Enterprise.
• [533511921] Low CVE-2026-79253: Improper input validation in Network.
• [533511967] Low CVE-2026-79260: Improper input validation in Cookies.
• [534556413] Low CVE-2026-79254: Incorrect reference resolution in CustomTabs.
• [536166543] Low CVE-2026-78914: Uninitialized resource in Skia.
• [539341100] Low CVE-2026-78964: Use after free in Sync.

The Keycloak Team reports:

• [CVE-2026-35563]: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname
• [CVE-2026-16093]: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers
• [CVE-2026-16072]: Organization managers can create managed members through stored registration links without manage-users
• [CVE-2026-16108]: Realm default-group reads disclose hidden groups under FGAP v2
• [CVE-2026-16105]: Missing per-role authorization on RoleContainerResource composite endpoints
• [CVE-2026-16089]: Authorization codes can be retargeted to another client session
• [CVE-2026-16104]: Authenticator config surfaces expose raw reCAPTCHA secrets
• [CVE-2026-16106]: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles
• [CVE-2026-17059]: Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter
• [CVE-2026-18218]: Client not-before revocation is ignored when realm not-before is older but nonzero
• [CVE-2026-18215]: Microsoft external access-token exchange bypasses configured tenant
• [CVE-2026-18201]: Generic identity-provider creation can bind brokers to organizations without manage-organizations
• [CVE-2026-18209]: Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment
• [CVE-2026-18214]: Google external access-token exchange bypasses hosted-domain restriction
• [CVE-2026-18571]: FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups
• [CVE-2026-18572]: UMA claim token can override the authorization time-policy clock
• [CVE-2026-18573]: Client access-type condition evaluates updates against the old client type
• [CVE-2026-18570]: Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed
• [CVE-2026-19729]: Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4
• [CVE-2026-79652]: Keycloak jwt-bearer authorization grant does not enforce consentRequired

Trifecta Tech Foundation reports:

Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories.

This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default configuration. For users that have full sudoedit permission or no sudoedit permission at all, no escalation is enabled by this bug.

A user that is allowed to place files in an arbitrary directory can (by placing a file in /etc/sudoers.d) obviously fully escalate their privileges.

Core Lightning team reports:

This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume and pace of security reports.

The potential impact and associated risks are front of mind for everyone involved, not least the remediation team who have worked tirelessly to triage, resolve, and compile this release.

This embargo period will last for two weeks. The source code will not be published until 14 days have passed. During this time, we strongly encourage everyone to upgrade. At the end of this two-week period, the full release details will be made available.

This delay is designed to reduce the chances of prospective attackers reverse-engineering the fixes and exploiting them before the network can update.

The phpBB Team reports:

Changes since 3.3.16: Improper state verification in OAuth implementation (SECURITY-293), improve secure downloads referer checking (SECURITY-292), hardening of hostname lookups (SECURITY-295).

Changes since 3.3.15: Password Reset Link Poisoning (SECURITY-285), IDOR when composing PMs (SECURITY-286), CSRF on report submission (SECURITY-287), Cross-User Notification Read State Manipulation (SECURITY-290), hardening against non-rasterized image uploads (SECURITY-289).

Changes since 3.3.14: Use jQuery to generate HTML from page data (SECURITY-283).

The password reset issue fixed in 3.3.16 has been assigned CVE-2026-29199 (CVSS 8.1). When force_server_vars is disabled, phpBB takes the host name from the HTTP Host header to build the password reset link, so an attacker able to control that header can have reset mails point to a domain under their control, which may lead to account takeover.

tomciopp reports:

Uncontrolled recursion in the Elixir standard library lets an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 exhaust a BEAM node's memory.

Inspect.List checks only a bounded prefix (4096 elements by default) to determine whether a list is a charlist, then attempts to convert the entire list. When a list contains a long printable prefix followed by an invalid element, the classification passes but the conversion fails. The error handling path then inspects the same list again, creating unbounded recursion that grows process memory until heap limits are exceeded or the node exhausts resources.

tomciopp reports:

Uncontrolled recursion in the Elixir standard library lets an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 exhaust a BEAM node's memory.

Inspect.List checks only a bounded prefix (4096 elements by default) to determine whether a list is a charlist, then attempts to convert the entire list. When a list contains a long printable prefix followed by an invalid element, the classification passes but the conversion fails. The error handling path then inspects the same list again, creating unbounded recursion that grows process memory until heap limits are exceeded or the node exhausts resources.

NLnet Labs reports:

• CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics.
• CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window (down to 1). Reported by akoul (Akhil Koul)
• CVE-2026-19401: Any remote client can denial UDP service by sending a specifically crafted query with multiple DNS Cookie options. Reported by Qifan Zhang from Palo Alto Networks and afldl.
• CVE-2026-19538: Anyone with access to the proxy protocol port over TCP or TLS can bypass BLOCKED access control items. Reported by Qifan Zhang from Palo Alto Networks.

Gitlab reports:

Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE

Denial of Service issue in import pipeline impacts GitLab CE/EE

Denial of Service issue in SCIM API impacts GitLab EE

Improper Access Control issue in protected environments impacts GitLab EE

Authorization Bypass issue in compliance framework assignment impacts GitLab EE

Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EE

Improper Authorization issue in merge request approval rules reset impacts GitLab EE

Composer project reports:

Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)

Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)

rsync project reports:

This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory, and many are much narrower than "everything before 3.5.0". Every fix ships with a regression test in the test suite that fails on the unfixed tree.

• CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked operator-supplied input files.
• CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via symlinked operator-supplied output paths.
• CVE-2026-53785 (HIGH): Under --relative, the receiver's implied-parent creation (make_path()) built the parent chain with a plain mkdir() on the full path.
• CVE-2026-53784 (HIGH): Daemon module-root chdir escape under use chroot = no.
• CVE-2026-53793 (HIGH): Chroot /./ inner-module escape a symlinked parent component.
• CVE-2026-53795 (HIGH): An absolute --temp-dir or --link-dest disabled the receiver's rename/link confinement.
• CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time chdir() into the operator-named destination was not fully confined.
• CVE-2026-53797 (MEDIUM): A non-daemon sender opened each transferred file's content by path (leaf O_NOFOLLOW only).
• CVE-2026-53799 (MEDIUM): Receiver ACL/xattr metadata application followed a symlink race.
• CVE-2026-53800 (MEDIUM): Sender --remove-source-files unlink followed a parent-component symlink race.
• CVE-2026-53801 (MEDIUM): Sender/daemon directory-scan enumeration escaped the transfer root / module.

support/rrsync (the restricted SSH wrapper):

• CVE-2026-53783 (HIGH): rrsync restricted-directory escape.

Daemon protocol / identity:

• CVE-2026-53786 (MEDIUM): A client-supplied --filter merge file bypassed the module filter list.
• CVE-2026-53798 (MEDIUM): The daemon name converter mapped an unknown name to uid/gid 0.
• CVE-2026-53788 (MEDIUM): A peer-controlled name containing a newline/CR was written verbatim into the name-converter line protocol.
• CVE-2026-53789 (MEDIUM): A malicious daemon-sender could widen --delete scope by omitting the "no content dir" flag on an implied parent.
• CVE-2026-53791 (CRITICAL): With proxy protocol = true, a client connecting directly (not via the trusted proxy) could send a PROXY header to spoof its source address.

Injection and memory safety:

• CVE-2026-53790 (HIGH): Command / argument injection via unquoted peer- or host-controlled values the RSYNC_CONNECT_PROG %H host substitution.
• CVE-2026-53792 (MEDIUM): A malicious receiver sending a checksum header with a block count > 0 but block length == 0 drove the sender's rolling-match arithmetic negative.
• CVE-2026-53794 (MEDIUM): --max-alloc=0 disabled the per-allocation size cap.

Peer-triggerable memory corruption in the daemon protocol:

• CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write in add_implied_include().
• CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry marked FLAG_HLINKED that the receiver accepted even though -H was not in effect.
• CVE-2026-70456 (HIGH): an out-of-bounds heap write in read_args() when the peer's argument count lands exactly on maxargs.
• CVE-2026-70457 (MEDIUM): an attacker-chosen-offset write in parse_size_arg()'s error formatting.
• CVE-2026-70459 (MEDIUM): a wild-pointer read crashing the per-connection daemon child.

Daemon availability and access control:

• CVE-2026-70464 (HIGH): an unauthenticated peer could complete the @RSYNCD greeting and then stall forever.
• CVE-2026-70455 (HIGH): a daemon client could request an arbitrary Zstandard worker count via --compress-threads.
• CVE-2026-70453 (HIGH): quadratic CPU exhaustion in hash_search() from a crafted chain of equal weak checksums.
• CVE-2026-70452 (HIGH): hosts deny failed OPEN when a configured hostname could not be resolved.
• CVE-2026-70463 (HIGH): auth users ignored its documented comma-only parsing.
• CVE-2026-70460 (HIGH): a peer-supplied --partial-dir or --backup-dir was resolved by pathname.

Client-side:

• CVE-2026-70462 (MEDIUM): a peer-supplied MSG_IO_TIMEOUT defeated the client's own I/O timeout.
• CVE-2026-70454 (MEDIUM): rsync-ssl established an unauthenticated TLS connection.

Conduit team reports:

Fixes a vulnerability where endpoints which required authentication, but functionality do not depend on the user/server calling it, could have their authentication bypassed, as well as causing crashes for all other authenticated endpoints. It is recommended you upgrade ASAP.

Problem Description:

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.

Impact:

An unprivileged local user can exploit this race to escalate privileges.

Problem Description:

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.

Impact:

An unprivileged local user can exploit this race condition to escalate privileges.

Problem Description:

ppp(8) contained three memory safety errors in its handling of multilink endpoint discriminator options.

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. [CVE-2026-58095]

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. [CVE-2026-58096]

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. [CVE-2026-58097]

Impact:

A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root. A local user with access to the ppp(8) command interface can exploit CVE-2026-58097 similarly.

Problem Description:

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.

One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.

As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array. If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.

Impact:

Certain mac_do rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug.

Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID.

Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".

Problem Description:

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.

Impact:

On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

Problem Description:

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.

Impact:

An unprivileged local user can exploit this use-after-free to escalate privileges.

Problem Description:

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly.

Impact:

An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

The OpenSSL poject reports:

• Heap Buffer Overflow in CMS Key Unwrapping (CVE-2026-63072) (Moderate)
• Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (CVE-2026-63076) (Moderate)
• RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (CVE-2026-14457) (Low)
• Excessive Memory Use Buffering DTLS Records for a Future Epoch (CVE-2026-54874) (Low)
• Untrusted Sender DN Used as Format String in CMP Response Validation (CVE-2026-63073) (Low)
• CMP Indefinite Cache Growth of ExtraCerts (CVE-2026-63074) (Low)
• QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (CVE-2026-63075) (Low)
• AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() (CVE-2026-75803) (Low)

The MariaDB project reports:

Details in links

The mod_gnutls project reports:

Security fix (CVE-2026-33307): Fix out-of-bounds write when receiving a client certificate chain longer than the buffer.

Security fix (CVE-2026-33308): Check Key Purpose during client certificate verification.

The Jackson project reports:

PolymorphicTypeValidator needs to validate generic type parameters too

BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray() should validate element type

Add java.lang.Comparable in set of "unsafe" polymorphic base types

@JsonView by-passed for @JsonUnwrapped Field/Setter properties

@JsonView by-passed for some "setterless" creator properties

@JsonView by-passed for unwrapped creator parameters

Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties

Renamed @JsonIgnore'd setters can deserialize via private fields

@JsonIgnore on Record property ignored with PropertyNamingStrategy

Case-insensitive deserialization may use wrong @JsonIgnoreProperties

Do not allow DNS resolution when deserializing InetAddress

Improve InetSocketAddress deserialization

Limit the supported URL schemes for java.nio.file.Path deserialization

Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration

The Jackson project reports:

Enforce maxNameLength incrementally in ReaderBasedJsonParser

Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set

Fix maxDocumentLength bypass in async parser single feedInput() case

Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser

UTF8DataInputJsonParser needs to enforce StreamReadConstraints.maxNameLength limit

The traefik project releases a new version addressing multiple vulnerabilities:

• GHSA-5w68-77r2-r64c (Complete authentication bypass in the `digestAuth` middleware)
• GHSA-g55h-rg46-x9c5 (TLS option confusion in multi-host routers can bypass mTLS for protected hosts)
• GHSA-j994-9gqj-9hwq (Same-host Ingress TLS option conflict disables client-certificate authentication)
• GHSA-m6wx-622r-48r9 (Kubernetes Ingress service middleware bypasses crossProviderNamespaces)

HashiCorp reports:

Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the same path. On filesystems that normalize filenames, a file whose displayed name appears to match an exclusion rule can still end up in the generated upload bundle, so local files an operator intended to keep out of remote runs may be transmitted.

Exploitation requires local control over the working directory contents, use of .terraformignore, and filenames and ignore patterns that differ only by Unicode normalization form. Setups that do not use .terraformignore, use ASCII-only filenames and patterns, or run on filesystems that do not perform this normalization are not affected.

Tailscale team reports:

Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11

Qt qtwebengine-chromium repo reports:

Backports for 747 security bugs in Chromium:

• CVE-2026-1643: Use after free in Proxy
• CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker
• CVE-2026-7943: Insufficient validation of untrusted input in ANGLE
• CVE-2026-7958: Inappropriate implementation in ServiceWorker
• CVE-2026-7962: Insufficient policy enforcement in DirectSockets
• CVE-2026-7979: Inappropriate implementation in Media
• CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver
• CVE-2026-8001: Use after free in Printing
• CVE-2026-8009: Inappropriate implementation in Cast
• CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation
• CVE-2026-8011: Insufficient policy enforcement in Search
• CVE-2026-8012: Inappropriate implementation in MHTML
• CVE-2026-8013: Insufficient validation of untrusted input in FedCM
• CVE-2026-8014: Inappropriate implementation in Preload
• CVE-2026-8015: Inappropriate implementation in Media
• CVE-2026-8016: Use after free in WebRTC
• CVE-2026-8017: Side-channel information leakage in Media
• CVE-2026-8020: Uninitialized Use in GPU
• CVE-2026-8022: Inappropriate implementation in MHTML
• CVE-2026-8510: Integer overflow in Skia
• CVE-2026-8511: Use after free in UI
• CVE-2026-8512: Use after free in FileSystem
• CVE-2026-8513: Use after free in Input
• CVE-2026-8514: Use after free in Aura
• CVE-2026-8515: Use after free in HID
• CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer
• CVE-2026-8518: Use after free in Blink
• CVE-2026-8523: Use after free in Mojo
• CVE-2026-8524: Out of bounds write in WebAudio
• CVE-2026-8525: Heap buffer overflow in ANGLE
• CVE-2026-8526: Out of bounds write in WebRTC
• CVE-2026-8528: Insufficient validation of untrusted input in SiteIsolation
• CVE-2026-8529: Heap buffer overflow in Codecs
• CVE-2026-8530: Use after free in Network
• CVE-2026-8532: Integer overflow in XML
• CVE-2026-8533: Use after free in Accessibility
• CVE-2026-8534: Integer overflow in GPU
• CVE-2026-8535: Out of bounds read in Media
• CVE-2026-8537: Insufficient policy enforcement in ViewTransitions
• CVE-2026-8538: Insufficient validation of untrusted input in GPU
• CVE-2026-8539: Script injection in SanitizerAPI
• CVE-2026-8542: Use after free in Core
• CVE-2026-8543: Out of bounds read in FileSystem
• CVE-2026-8544: Use after free in Media
• CVE-2026-8545: Object corruption in Compositing
• CVE-2026-8546: Out of bounds read in GPU
• CVE-2026-8548: Out of bounds write in Media
• CVE-2026-8549: Use after free in Media
• CVE-2026-8552: Heap buffer overflow in GPU
• CVE-2026-8553: Use after free in GPU
• CVE-2026-8554: Type confusion in ANGLE
• CVE-2026-8556: Inappropriate implementation in ANGLE
• CVE-2026-8557: Use after free in Accessibility
• CVE-2026-8558: Out of bounds write in Fonts
• CVE-2026-8559: Integer overflow in Internationalization
• CVE-2026-8560: Heap buffer overflow in SwiftShader
• CVE-2026-8567: Integer overflow in ANGLE
• CVE-2026-8569: Out of bounds write in Codecs
• CVE-2026-8571: Insufficient policy enforcement in GPU
• CVE-2026-8573: Integer overflow in Codecs
• CVE-2026-8577: Integer overflow in Fonts
• CVE-2026-8578: Out of bounds read in GPU
• CVE-2026-8579: Insufficient validation of untrusted input in Skia
• CVE-2026-8581: Use after free in GPU
• CVE-2026-8582: Object lifecycle issue in Dawn
• CVE-2026-8584: Inappropriate implementation in Views
• CVE-2026-8585: Inappropriate implementation in Media
• CVE-2026-9111: Use after free in WebRTC
• CVE-2026-9112: Use after free in GPU
• CVE-2026-9115: Insufficient policy enforcement in Service Worker
• CVE-2026-9116: Insufficient policy enforcement in ServiceWorker
• CVE-2026-9118: Use after free in XR
• CVE-2026-9119: Heap buffer overflow in WebRTC
• CVE-2026-9121: Out of bounds read in GPU
• CVE-2026-9122: Out of bounds read in GPU
• CVE-2026-9124: Insufficient validation of untrusted input in Input
• CVE-2026-9126: Use after free in DOM
• CVE-2026-9872: Out of bounds write in GPU
• CVE-2026-9873: Use after free in Network
• CVE-2026-9875: Out of bounds read in WebGL
• CVE-2026-9876: Use after free in WebGL
• CVE-2026-9877: Use after free in ANGLE
• CVE-2026-9878: Use after free in ANGLE
• CVE-2026-9879: Out of bounds write in ANGLE
• CVE-2026-9880: Insufficient validation of untrusted input in WebGL
• CVE-2026-9881: Use after free in Bluetooth
• CVE-2026-9882: Integer overflow in ANGLE
• CVE-2026-9883: Use after free in Base
• CVE-2026-9885: Insufficient validation of untrusted input in UI
• CVE-2026-9886: Use after free in Base
• CVE-2026-9887: Use after free in Proxy
• CVE-2026-9889: Out of bounds read and write in Dawn
• CVE-2026-9890: Use after free in XR
• CVE-2026-9891: Use after free in Extensions
• CVE-2026-9892: Inappropriate implementation in Skia
• CVE-2026-9893: Use after free in Skia
• CVE-2026-9894: Use after free in GPU
• CVE-2026-9895: Out of bounds read in GPU
• CVE-2026-9896: Out of bounds write in V8
• CVE-2026-9897: Use after free in DOM
• CVE-2026-9899: Use after free in ANGLE
• CVE-2026-9900: Out of bounds write in ANGLE
• CVE-2026-9901: Use after free in ANGLE
• CVE-2026-9902: Use after free in Accessibility
• CVE-2026-9903: Insufficient validation of untrusted input in Site Isolation
• CVE-2026-9904: Use after free in ANGLE
• CVE-2026-9906: Out of bounds write in GPU
• CVE-2026-9908: Out of bounds read in ANGLE
• CVE-2026-9909: Integer overflow in Skia
• CVE-2026-9910: Out of bounds memory access in ANGLE
• CVE-2026-9911: Integer overflow in ANGLE
• CVE-2026-9914: Insufficient validation of untrusted input in ANGLE
• CVE-2026-9915: Heap buffer overflow in ANGLE
• CVE-2026-9916: Out of bounds write in ANGLE
• CVE-2026-9918: Inappropriate implementation in Tint
• CVE-2026-9919: Out of bounds read in WebGL
• CVE-2026-9920: Uninitialized Use in GPU
• CVE-2026-9921: Uninitialized Use in WebGL
• CVE-2026-9922: Use after free in GPU
• CVE-2026-9924: Heap buffer overflow in ANGLE
• CVE-2026-9925: Use after free in ANGLE
• CVE-2026-9926: Heap buffer overflow in ANGLE
• CVE-2026-9927: Use after free in ANGLE
• CVE-2026-9928: Out of bounds read in ANGLE
• CVE-2026-9929: Inappropriate implementation in WebGL
• CVE-2026-9930: Out of bounds write in Dawn
• CVE-2026-9931: Use after free in GPU
• CVE-2026-9932: Use after free in ANGLE
• CVE-2026-9933: Use after free in Input
• CVE-2026-9934: Use after free in Aura
• CVE-2026-9935: Uninitialized Use in ANGLE
• CVE-2026-9936: Use after free in GFX
• CVE-2026-9937: Use after free in UI
• CVE-2026-9938: Inappropriate implementation in V8
• CVE-2026-9939: Heap buffer overflow in WebCodecs
• CVE-2026-9940: Heap buffer overflow in ANGLE
• CVE-2026-9941: Use after free in ANGLE
• CVE-2026-9942: Uninitialized Use in ANGLE
• CVE-2026-9943: Out of bounds read in WebGL
• CVE-2026-9944: Uninitialized Use in ANGLE
• CVE-2026-9945: Use after free in Media
• CVE-2026-9946: Use after free in ANGLE
• CVE-2026-9947: Use after free in XML
• CVE-2026-9948: Use after free in Views
• CVE-2026-9951: Use after free in UI
• CVE-2026-9953: Out of bounds read in ANGLE
• CVE-2026-9957: Use after free in PDF
• CVE-2026-9959: Race in WebRTC
• CVE-2026-9960: Integer overflow in PDFium
• CVE-2026-9962: Use after free in WebRTC
• CVE-2026-9964: Use after free in Bluetooth
• CVE-2026-9967: Out of bounds write in GPU
• CVE-2026-9968: Integer overflow in V8
• CVE-2026-9969: Insufficient validation of untrusted input in ANGLE
• CVE-2026-9970: Use after free in WebGL
• CVE-2026-9972: Uninitialized Use in Gamepad
• CVE-2026-9973: Out of bounds write in V8
• CVE-2026-9974: Out of bounds write in GPU
• CVE-2026-9975: Out of bounds read and write in ANGLE
• CVE-2026-9976: Inappropriate implementation in USB
• CVE-2026-9979: Insufficient validation of untrusted input in Input
• CVE-2026-9981: Inappropriate implementation in Skia
• CVE-2026-9982: Insufficient validation of untrusted input in ANGLE
• CVE-2026-9983: Type confusion in Skia
• CVE-2026-9985: Insufficient validation of untrusted input in Media
• CVE-2026-9988: Use after free in WebRTC
• CVE-2026-9989: Inappropriate implementation in Media
• CVE-2026-9992: Use after free in Network
• CVE-2026-9993: Use after free in Views
• CVE-2026-9994: Use after free in Core
• CVE-2026-9995: Use after free in WebXR
• CVE-2026-9996: Out of bounds read in WebRTC
• CVE-2026-9997: Use after free in Input
• CVE-2026-9998: Integer overflow in Skia
• CVE-2026-9999: Inappropriate implementation in ANGLE
• CVE-2026-10002: Use after free in PDFium
• CVE-2026-10003: Use after free in Views
• CVE-2026-10004: Insufficient validation of untrusted input in Passwords
• CVE-2026-10006: Race in WebAudio
• CVE-2026-10007: Use after free in SVG
• CVE-2026-10008: Uninitialized Use in GPU
• CVE-2026-10009: Integer overflow in Skia
• CVE-2026-10011: Inappropriate implementation in Skia
• CVE-2026-10013: Use after free in WebCodecs
• CVE-2026-10016: Use after free in DOM
• CVE-2026-10017: Out of bounds read in Headless
• CVE-2026-10020: Insufficient validation of untrusted input in Skia
• CVE-2026-10022: Type confusion in V8
• CVE-2026-10882: Use after free in Network
• CVE-2026-10883: Out of bounds write in ANGLE
• CVE-2026-10884: Use after free in Chromecas
• CVE-2026-10886: Use after free in FileSystem
• CVE-2026-10888: Use after free in Cast Streaming
• CVE-2026-10889: Out of bounds read in ANGLE
• CVE-2026-10890: Use after free in Cast
• CVE-2026-10891: Use after free in GFX
• CVE-2026-10892: Out of bounds write in GPU
• CVE-2026-10897: Out of bounds write in GPU
• CVE-2026-10905: Use after free in Network
• CVE-2026-10907: Out of bounds write in ANGLE
• CVE-2026-10908: Use after free in FullScreen
• CVE-2026-10909: Use after free in Dawn
• CVE-2026-10910: Type confusion in V8
• CVE-2026-10911: Insufficient validation of untrusted input in Media
• CVE-2026-10912: Insufficient validation of untrusted input in Extensions
• CVE-2026-10913: Use after free in ANGLE
• CVE-2026-10914: Use after free in ANGLE
• CVE-2026-10916: Insufficient validation of untrusted input in DevTools"
• CVE-2026-10917: Insufficient validation of untrusted input in Media
• CVE-2026-10918: Use after free in Viz
• CVE-2026-10921: Integer overflow in Dawn
• CVE-2026-10925: Out of bounds write in Skia
• CVE-2026-10929: Heap buffer overflow in ANGLE
• CVE-2026-10930: Out of bounds read in ANGLE
• CVE-2026-10933: Use after free in Audio
• CVE-2026-10938: Insufficient validation of untrusted input in Input
• CVE-2026-10939: Use after free in WebRTC
• CVE-2026-10942: Insufficient validation of untrusted input in UI
• CVE-2026-10945: Use after free in PDF
• CVE-2026-10946: Heap buffer overflow in Media
• CVE-2026-10947: Use after free in WebRTC
• CVE-2026-10948: Use after free in WebRTC
• CVE-2026-10949: Heap buffer overflow in Video
• CVE-2026-10953: Use after free in Core
• CVE-2026-10956: Use after free in MimeHandlerView
• CVE-2026-10959: Use after free in Input
• CVE-2026-10960: Uninitialized Use in Codecs
• CVE-2026-10963: Integer overflow in V8
• CVE-2026-10964: Integer overflow in V8
• CVE-2026-10965: Integer overflow in DevTools
• CVE-2026-10968: Insufficient validation of untrusted input in Dawn
• CVE-2026-10969: Insufficient validation of untrusted input in Extensions
• CVE-2026-10970: Insufficient validation of untrusted input in InterestGroups
• CVE-2026-10973: Uninitialized Use in Dawn
• CVE-2026-10974: Insufficient validation of untrusted input in ANGLE
• CVE-2026-10975: Use after free in WebRTC
• CVE-2026-10976: Uninitialized Use in Dawn
• CVE-2026-10977: Uninitialized Use in Skia
• CVE-2026-10979: Out of bounds read in ANGLE
• CVE-2026-10981: Insufficient validation of untrusted input in Codecs
• CVE-2026-10982: Use after free in WebXR
• CVE-2026-10983: Insufficient validation of untrusted input in Dawn
• CVE-2026-10985: Out of bounds read in Skia
• CVE-2026-10986: Integer overflow in Media
• CVE-2026-10987: Integer overflow in V8
• CVE-2026-10989: Inappropriate implementation in V8
• CVE-2026-10991: Use after free in V8
• CVE-2026-10992: Insufficient data validation in Animation
• CVE-2026-10994: Uninitialized Use in ANGLE
• CVE-2026-10996: Inappropriate implementation in Workers
• CVE-2026-10997: Insufficient policy enforcement in Extensions
• CVE-2026-10999: Out of bounds memory access in ANGLE
• CVE-2026-11000: Use after free in Fonts
• CVE-2026-11003: Use after free in WebRTC
• CVE-2026-11004: Out of bounds read in ANGLE
• CVE-2026-11005: Out of bounds read in ANGLE
• CVE-2026-11006: Out of bounds read in Dawn
• CVE-2026-11008: Insufficient validation of untrusted input in WebAppInstalls
• CVE-2026-11009: Use after free in USB
• CVE-2026-11011: Insufficient policy enforcement in Password Manager
• CVE-2026-11013: Insufficient validation of untrusted input in Network
• CVE-2026-11014: Insufficient policy enforcement in Extensions
• CVE-2026-11015: Out of bounds read in WebGPU
• CVE-2026-11016: Insufficient validation of untrusted input in Network
• CVE-2026-11020: Inappropriate implementation in Extensions
• CVE-2026-11021: Insufficient validation of untrusted input in GPU
• CVE-2026-11022: Insufficient validation of untrusted input in DevTools
• CVE-2026-11024: Stack buffer overflow in Skia
• CVE-2026-11026: Insufficient policy enforcement in Extensions
• CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop
• CVE-2026-11030: Use after free in Network
• CVE-2026-11031: Insufficient validation of untrusted input in Password Manager
• CVE-2026-11036: Inappropriate implementation in DOM
• CVE-2026-11037: Out of bounds write in Codecs
• CVE-2026-11038: Insufficient validation of untrusted input in Subresource Integrity
• CVE-2026-11039: Uninitialized Use in Skia
• CVE-2026-11041: Insufficient validation of untrusted input in Media
• CVE-2026-11042: Use after free in Views
• CVE-2026-11043: Out of bounds write in ANGLE
• CVE-2026-11044: Integer overflow in ANGLE
• CVE-2026-11045: Insufficient validation of untrusted input in GPU
• CVE-2026-11046: Insufficient validation of untrusted input in Media
• CVE-2026-11047: Insufficient validation of untrusted input in Base
• CVE-2026-11048: Inappropriate implementation in Extensions
• CVE-2026-11049: Use after free in Password Manager
• CVE-2026-11050: Use after free in V8
• CVE-2026-11051: Out of bounds read in ANGLE
• CVE-2026-11052: Type confusion in GPU
• CVE-2026-11053: Race condition in WebRTC
• CVE-2026-11054: Use after free in WebRTC
• CVE-2026-11055: Use after free in ANGLE
• CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation
• CVE-2026-11057: Uninitialized Use in Skia
• CVE-2026-11059: Use after free in Blink
• CVE-2026-11060: Use after free in Media
• CVE-2026-11061: Out of bounds read in ANGLE
• CVE-2026-11062: Insufficient policy enforcement in Extensions
• CVE-2026-11064: Uninitialized Use in GPU
• CVE-2026-11065: Use after free in ANGLE
• CVE-2026-11067: Uninitialized Use in Dawn
• CVE-2026-11068: Use after free in WebSockets
• CVE-2026-11071: Use after free in Base
• CVE-2026-11073: Use after free in WebGL
• CVE-2026-11074: Use after free in WebRTC
• CVE-2026-11075: Out of bounds read in V8
• CVE-2026-11076: Type confusion in CSS
• CVE-2026-11077: Out of bounds read in Dawn
• CVE-2026-11078: Insufficient validation of untrusted input in FileSystem
• CVE-2026-11079: Insufficient validation of untrusted input in Codecs
• CVE-2026-11082: Use after free in GPU
• CVE-2026-11085: Integer overflow in GPU
• CVE-2026-11086: Insufficient validation of untrusted input in Dawn
• CVE-2026-11087: Uninitialized Use in ANGLE
• CVE-2026-11088: Integer overflow in ANGLE
• CVE-2026-11089: Uninitialized Use in Media
• CVE-2026-11090: Uninitialized Use in ANGLE
• CVE-2026-11091: Inappropriate implementation in Dawn
• CVE-2026-11092: Insufficient policy enforcement in DevTools
• CVE-2026-11093: Insufficient validation of untrusted input in Printing
• CVE-2026-11095: Insufficient validation of untrusted input in Codecs
• CVE-2026-11096: Out of bounds read in WebRTC
• CVE-2026-11098: Insufficient validation of untrusted input in GPU
• CVE-2026-11099: Vulnerability in Skia
• CVE-2026-11101: Uninitialized Use in Dawn
• CVE-2026-11104: Uninitialized Use in ANGLE
• CVE-2026-11105: Insufficient validation of untrusted input in WebUI
• CVE-2026-11106: Inappropriate implementation in Media
• CVE-2026-11107: Inappropriate implementation in Downloads
• CVE-2026-11109: Uninitialized Use in ANGLE
• CVE-2026-11110: Uninitialized Use in ANGLE
• CVE-2026-11111: Out of bounds read in ANGLE
• CVE-2026-11113: Insufficient validation of untrusted input in ANGLE
• CVE-2026-11117: Use after free in Views
• CVE-2026-11118: Use after free in WebRTC
• CVE-2026-11119: Insufficient validation of untrusted input in GPU
• CVE-2026-11121: Insufficient validation of untrusted input in Skia
• CVE-2026-11122: Inappropriate implementation in Keyboard
• CVE-2026-11123: Uninitialized Use in ANGLE
• CVE-2026-11124: Heap buffer overflow in Skia
• CVE-2026-11125: Use after free in Compositing
• CVE-2026-11126: Insufficient validation of untrusted input in DevTools
• CVE-2026-11128: Insufficient validation of untrusted input in Web Share
• CVE-2026-11132: Policy bypass in Paint
• CVE-2026-11133: Insufficient policy enforcement in Paint
• CVE-2026-11134: Insufficient data validation in Media
• CVE-2026-11136: Use after free in Canvas
• CVE-2026-11137: Uninitialized Use in ANGLE
• CVE-2026-11138: Uninitialized Use in ANGLE
• CVE-2026-11139: Policy bypass in Paint
• CVE-2026-11141: Uninitialized Use in Audio
• CVE-2026-11142: Policy bypass in Paint
• CVE-2026-11143: Heap buffer overflow in Extensions
• CVE-2026-11152: Object lifecycle issue in Dawn
• CVE-2026-11153: Side-channel information leakage in Forms
• CVE-2026-11154: Use after free in Dawn
• CVE-2026-11155: Insufficient policy enforcement in CSS
• CVE-2026-11156: Inappropriate implementation in CSS
• CVE-2026-11159: Uninitialized Use in Skia
• CVE-2026-11160: Out of bounds read in Input
• CVE-2026-11161: Insufficient data validation in DataTransfer
• CVE-2026-11162: Insufficient policy enforcement in CSS
• CVE-2026-11164: Use after free in Blink
• CVE-2026-11166: Inappropriate implementation in SVG
• CVE-2026-11171: Integer overflow in Blink
• CVE-2026-11174: Insufficient policy enforcement in Site Isolation
• CVE-2026-11176: Inappropriate implementation in Media
• CVE-2026-11179: Inappropriate implementation in ORB
• CVE-2026-11181: Inappropriate implementation in Media Session
• CVE-2026-11182: Inappropriate implementation in SVG
• CVE-2026-11183: Out of bounds read in GWP-ASan
• CVE-2026-11185: Use after free in V8
• CVE-2026-11186: Inappropriate implementation in CSS
• CVE-2026-11189: Insufficient validation of untrusted input in DevTools
• CVE-2026-11190: Insufficient policy enforcement in Extensions
• CVE-2026-11191: Out of bounds memory access in ANGLE
• CVE-2026-11194: Inappropriate implementation in Network
• CVE-2026-11195: Inappropriate implementation in MHTML
• CVE-2026-11196: Type confusion in XML
• CVE-2026-11197: Insufficient policy enforcement in Workers
• CVE-2026-11198: Insufficient validation of untrusted input in Codecs
• CVE-2026-11199: Insufficient validation of untrusted input in WebRTC
• CVE-2026-11200: Inappropriate implementation in WebRTC Medium
• CVE-2026-11201: Use after free in ServiceWorker
• CVE-2026-11206: Policy bypass in ServiceWorker
• CVE-2026-11207: Insufficient validation of untrusted input in Autofill
• CVE-2026-11208: Use after free in Codecs
• CVE-2026-11209: Insufficient policy enforcement in Passwords
• CVE-2026-11211: Integer overflow in V8
• CVE-2026-11217: Insufficient policy enforcement in Fenced Frames
• CVE-2026-11218: Inappropriate implementation in PlatformIntegration
• CVE-2026-11219: Insufficient data validation in Navigation
• CVE-2026-11221: Insufficient validation of untrusted input in PointerLock
• CVE-2026-11223: Insufficient validation of untrusted input in Network
• CVE-2026-11230: Use after free in Extensions
• CVE-2026-11233: Insufficient validation of untrusted input in FoldableAPIs
• CVE-2026-11235: Insufficient validation of untrusted input in Compositing
• CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth
• CVE-2026-11237: Insufficient validation of untrusted input in Media
• CVE-2026-11238: Inappropriate implementation in DevTools
• CVE-2026-11240: Insufficient validation of untrusted input in Loader
• CVE-2026-11244: Insufficient validation of untrusted input in WebAuthentication
• CVE-2026-11245: Inappropriate implementation in Payments
• CVE-2026-11246: Insufficient validation of untrusted input in IndexedDB
• CVE-2026-11249: Use after free in Network
• CVE-2026-11250: Inappropriate implementation in DevTools
• CVE-2026-11252: Policy bypass in Content Settings
• CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API
• CVE-2026-11256: Out of bounds read in GPU
• CVE-2026-11260: Policy bypass in Permissions
• CVE-2026-11264: Policy bypass in Content Security Policy
• CVE-2026-11266: Policy bypass in SafeBrowsing
• CVE-2026-11267: Insufficient policy enforcement in Extensions
• CVE-2026-11268: Uninitialized Use in ANGLE
• CVE-2026-11269: Inappropriate implementation in Extensions
• CVE-2026-11279: Out of bounds read in DevTools
• CVE-2026-11282: Policy bypass in Sandbox
• CVE-2026-11288: Policy bypass in CSS
• CVE-2026-11289: Side-channel information leakage in Paint
• CVE-2026-11292: Policy bypass in Blink
• CVE-2026-11293: Use after free in Input
• CVE-2026-11295: Inappropriate implementation in WebView
• CVE-2026-11296: Inappropriate implementation in ImageCapture
• CVE-2026-11303: Use after free in PDFium
• CVE-2026-11304: Use after free in PDFium
• CVE-2026-11305: Use after free in PDFium
• CVE-2026-11306: Use after free in PDFium
• CVE-2026-11307: Use after free in PDFium
• CVE-2026-11309: Insufficient policy enforcement in History
• CVE-2026-11633: Use after free in Bluetooth
• CVE-2026-11634: Use after free in Gamepad
• CVE-2026-11635: Use after free in Bluetooth
• CVE-2026-11640: Integer overflow in libyuv
• CVE-2026-11641: Use after free in Bluetooth
• CVE-2026-11645: Out of bounds memory access in V8
• CVE-2026-11648: Use after free in FullScreen
• CVE-2026-11649: Use after free in V8
• CVE-2026-11651: Use after free in Network
• CVE-2026-11652: Use after free in Network
• CVE-2026-11654: Use after free in CameraCapture
• CVE-2026-11655: Integer overflow in Media
• CVE-2026-11662: Type confusion in Bindings
• CVE-2026-11663: Use after free in Skia
• CVE-2026-11665: Out of bounds read in Dawn
• CVE-2026-11666: Insufficient validation of untrusted input in Input
• CVE-2026-11667: Out of bounds read in WebRTC
• CVE-2026-11668: Uninitialized Use in Codecs
• CVE-2026-11669: Integer overflow in Media
• CVE-2026-11670: Use after free in PDF
• CVE-2026-11672: Out of bounds write in GPU
• CVE-2026-11673: Use after free in InterestGroups
• CVE-2026-11674: Use after free in Guest View
• CVE-2026-11675: Insufficient validation of untrusted input in Skia
• CVE-2026-11676: Insufficient validation of untrusted input in Dawn
• CVE-2026-11677: Race in Network
• CVE-2026-11678: Integer overflow in libyuv
• CVE-2026-11680: Use after free in Media
• CVE-2026-11683: Use after free in WebCodecs
• CVE-2026-11684: Insufficient policy enforcement in Network
• CVE-2026-11686: Insufficient validation of untrusted input in Dawn
• CVE-2026-11688: Object lifecycle issue in SVG
• CVE-2026-11690: Out of bounds read and write in Media
• CVE-2026-11694: Use after free in ServiceWorker
• CVE-2026-11696: Uninitialized Use in Video
• CVE-2026-11697: Insufficient validation of untrusted input in UI
• CVE-2026-11698: Use after free in Bluetooth
• CVE-2026-11699: Use after free in Bluetooth
• CVE-2026-11700: Use after free in Tracing
• CVE-2026-12007: Use after free in Core
• CVE-2026-12009: Insufficient validation of untrusted input in Accessibility
• CVE-2026-12010: Heap buffer overflow in GPU
• CVE-2026-12011: Use after free in WebMIDI
• CVE-2026-12012: Use after free Network
• CVE-2026-12013: Use after free Media
• CVE-2026-12016: Insufficient validation of untrusted input DevTools
• CVE-2026-12017: Insufficient validation of untrusted input Extensions
• CVE-2026-12018: Inappropriate implementation Mojo
• CVE-2026-12019: Out of bounds write Codecs
• CVE-2026-12023: Use after free GPU
• CVE-2026-12025: Insufficient validation of untrusted input Network
• CVE-2026-12026: Out of bounds read Video
• CVE-2026-12030: Heap buffer overflow GPU
• CVE-2026-12031: Inappropriate implementation Views
• CVE-2026-12033: Out of bounds read VideoCapture
• CVE-2026-12035: Use after free Views
• CVE-2026-12445: Use after free in Extensions
• CVE-2026-12446: Insufficient data validation in Passwords
• CVE-2026-12447: Heap buffer overflow in WebRTC
• CVE-2026-12450: Inappropriate implementation in Media
• CVE-2026-12453: Insufficient validation of untrusted input in Input
• CVE-2026-12456: Insufficient validation of untrusted input in Extensions
• CVE-2026-12459: Inappropriate implementation in Serial
• CVE-2026-12460: Insufficient policy enforcement in File System Access
• CVE-2026-12461: Out of bounds read in WebRTC
• CVE-2026-12462: Use after free in Media
• CVE-2026-12464: Use after free in Browser
• CVE-2026-12465: Insufficient validation of untrusted input in Metrics
• CVE-2026-12466: Heap buffer overflow in WebRTC
• CVE-2026-13023: Uninitialized Use in GPU
• CVE-2026-13024: Insufficient validation of untrusted input in Navigation
• CVE-2026-13027: Use after free in FileSystem
• CVE-2026-13028: Use after free in WebGL
• CVE-2026-13029: Use after free in Web Authentication
• CVE-2026-13031: Use after free in Blink
• CVE-2026-13032: Use after free in WebGL
• CVE-2026-13033: Out of bounds read in Blink>InterestGroups
• CVE-2026-13034: Inappropriate implementation in Passwords
• CVE-2026-13035: Use after free in Bluetooth
• CVE-2026-13281: Integer overflow in Mojo
• CVE-2026-13775: Use after free in GPU
• CVE-2026-13776: Type confusion in Dawn
• CVE-2026-13778: Use after free in WebUSB
• CVE-2026-13780: Insufficient validation of untrusted input in ANGLE
• CVE-2026-13783: Use after free in Views
• CVE-2026-13784: Use after free in Views
• CVE-2026-13785: Use after free in Bluetooth
• CVE-2026-13790: Side-channel information leakage in Scroll
• CVE-2026-13791: Insufficient validation of untrusted input in Downloads
• CVE-2026-13793: Insufficient policy enforcement in SVG
• CVE-2026-13799: Use after free in QUIC
• CVE-2026-13802: Use after free in Views
• CVE-2026-13806: Insufficient validation of untrusted input in Accessibility
• CVE-2026-13810: Inappropriate implementation in Input
• CVE-2026-13811: Use after free in IME
• CVE-2026-13814: Use after free in Views
• CVE-2026-13819: Out of bounds read in ANGLE
• CVE-2026-13824: Insufficient validation of untrusted input in Extensions
• CVE-2026-13825: Uninitialized Use in Dawn
• CVE-2026-13833: Uninitialized Use in ANGLE
• CVE-2026-13834: Insufficient validation of untrusted input in ANGLE
• CVE-2026-13835: Inappropriate implementation in XML
• CVE-2026-13836: Inappropriate implementation in CSS
• CVE-2026-13837: Inappropriate implementation in CSS
• CVE-2026-13841: Integer overflow in Skia
• CVE-2026-13845: Use after free in DOM
• CVE-2026-13846: Use after free in USB
• CVE-2026-13848: Use after free in Forms
• CVE-2026-13857: Inappropriate implementation in Geometry
• CVE-2026-13858: Out of bounds read in FFmpeg
• CVE-2026-13859: Inappropriate implementation in ANGLE
• CVE-2026-13861: Use after free in Core
• CVE-2026-13869: Use after free in Device
• CVE-2026-13871: Insufficient data validation in GuestView
• CVE-2026-13873: Out of bounds memory access in Layout
• CVE-2026-13875: Insufficient validation of untrusted input in GPU
• CVE-2026-13876: Inappropriate implementation in Network
• CVE-2026-13877: Insufficient validation of untrusted input in ANGLE
• CVE-2026-13878: Use after free in Bluetooth
• CVE-2026-13879: Use after free in Bluetooth
• CVE-2026-13880: Use after free in USB
• CVE-2026-13882: Inappropriate implementation in USB
• CVE-2026-13883: Type confusion in ANGLE
• CVE-2026-13886: Policy bypass in Isolated Web Apps
• CVE-2026-13891: Insufficient validation of untrusted input in Extensions
• CVE-2026-13893: Insufficient validation of untrusted input in WebUI
• CVE-2026-13899: Use after free in HTML
• CVE-2026-13901: Insufficient validation of untrusted input in Serial
• CVE-2026-13903: Insufficient policy enforcement in Bluetooth
• CVE-2026-13906: Out of bounds read in Codecs
• CVE-2026-13909: Insufficient policy enforcement in DevTools
• CVE-2026-13910: Insufficient policy enforcement in WebXR
• CVE-2026-13919: Insufficient data validation in Extensions
• CVE-2026-13920: Insufficient validation of untrusted input in Media
• CVE-2026-13922: Side-channel information leakage in Paint
• CVE-2026-13923: Uninitialized Use in GPU
• CVE-2026-13925: Inappropriate implementation in Downloads
• CVE-2026-13931: Inappropriate implementation in Media
• CVE-2026-13934: Insufficient validation of untrusted input in Dawn
• CVE-2026-13935: Side-channel information leakage in ComputePressure
• CVE-2026-13938: Integer overflow in Fonts
• CVE-2026-13942: Insufficient validation of untrusted input in Video Capture
• CVE-2026-13943: Uninitialized Use in CSS
• CVE-2026-13944: Inappropriate implementation in DataTransfe
• CVE-2026-13947: Uninitialized Use in XR
• CVE-2026-13950: Uninitialized Use in GPU
• CVE-2026-13951: Policy bypass in USB
• CVE-2026-13952: Inappropriate implementation in PerformanceAPIs
• CVE-2026-13954: Insufficient policy enforcement in XML
• CVE-2026-13958: Uninitialized Use in Codecs
• CVE-2026-13959: Insufficient validation of untrusted input in Blink
• CVE-2026-13961: Insufficient validation of untrusted input in DevTools
• CVE-2026-13965: Use after free in Oilpan
• CVE-2026-13966: Inappropriate implementation in History
• CVE-2026-13969: Uninitialized Use in UI
• CVE-2026-13970: Uninitialized Use in Media
• CVE-2026-13971: Uninitialized Use in Skia
• CVE-2026-13972: Inappropriate implementation in Paint
• CVE-2026-13975: Out of bounds read in ANGLE
• CVE-2026-13976: Heap buffer overflow in Storage
• CVE-2026-13977: Inappropriate implementation in HTMLParser
• CVE-2026-13979: Inappropriate implementation in Paint
• CVE-2026-13988: Inappropriate implementation in Paint
• CVE-2026-13992: Inappropriate implementation in UI
• CVE-2026-13998: Incorrect security UI in File Input
• CVE-2026-13999: Inappropriate implementation in Extensions
• CVE-2026-14001: Inappropriate implementation in Network
• CVE-2026-14002: Inappropriate implementation in Geolocation
• CVE-2026-14003: Insufficient policy enforcement in Extensions
• CVE-2026-14004: Inappropriate implementation in CSS
• CVE-2026-14006: Use after free in Navigation
• CVE-2026-14008: Uninitialized Use in WebXR
• CVE-2026-14009: Insufficient data validation in Passwords
• CVE-2026-14010: Uninitialized Use in Codecs
• CVE-2026-14011: Out of bounds read in SurfaceCapture
• CVE-2026-14012: Side-channel information leakage in CSS
• CVE-2026-14013: Inappropriate implementation in SVG
• CVE-2026-14015: Inappropriate implementation in WebRTC
• CVE-2026-14016: Insufficient policy enforcement in SVG
• CVE-2026-14017: Inappropriate implementation in Navigation
• CVE-2026-14020: Insufficient validation of untrusted input in WebXR
• CVE-2026-14022: Insufficient validation of untrusted input in Network
• CVE-2026-14023: Insufficient validation of untrusted input in SanitizerAPI
• CVE-2026-14025: Use after free in Views
• CVE-2026-14032: Use after free in Bluetooth
• CVE-2026-14034: Inappropriate implementation in WebXR
• CVE-2026-14035: Insufficient policy enforcement in Bluetooth
• CVE-2026-14036: Insufficient policy enforcement in Bluetooth
• CVE-2026-14037: Insufficient policy enforcement in GPU
• CVE-2026-14039: Insufficient policy enforcement in GetUserMedia
• CVE-2026-14040: Use after free in BrowserTag
• CVE-2026-14043: Use after free in GetUserMedia
• CVE-2026-14044: Use after free in ANGLE
• CVE-2026-14384: Out of bounds read in ANGLE
• CVE-2026-14385: Heap buffer overflow in ANGLE
• CVE-2026-14386: Out of bounds read in ANGLE
• CVE-2026-14388: Out of bounds read in ANGLE
• CVE-2026-14389: Integer overflow in Skia
• CVE-2026-14390: Use after free in ANGLE
• CVE-2026-14391: Integer overflow in ANGLE
• CVE-2026-14392: Out of bounds write in Tint
• CVE-2026-14393: Use after free in V8
• CVE-2026-14396: Out of bounds read in ANGLE
• CVE-2026-14397: Out of bounds write in ANGLE
• CVE-2026-14398: Use after free in ANGLE
• CVE-2026-14399: Uninitialized Use in Dawn
• CVE-2026-14400: Out of bounds write in ANGLE
• CVE-2026-14401: Insufficient validation of untrusted input in ANGLE
• CVE-2026-14402: Uninitialized Use in ANGLE
• CVE-2026-14404: Inappropriate implementation in PDFium
• CVE-2026-14406: Out of bounds read in V8
• CVE-2026-14407: Inappropriate implementation in V8
• CVE-2026-14408: Uninitialized Use in Dawn
• CVE-2026-14411: Insufficient validation of untrusted input in ANGLE
• CVE-2026-14412: Insufficient validation of untrusted input in ANGLE
• CVE-2026-14413: Uninitialized Use in ANGLE
• CVE-2026-14414: Insufficient validation of untrusted input in Skia
• CVE-2026-14417: Use after free in Dawn
• CVE-2026-14418: Uninitialized Use in ANGLE
• CVE-2026-14420: Out of bounds read and write in Dawn
• CVE-2026-14421: Uninitialized Use in Dawn
• CVE-2026-14422: Out of bounds read and write in Tint
• CVE-2026-14426: Use after free in V8
• CVE-2026-14427: Heap buffer overflow in Skia
• CVE-2026-14428: Insufficient validation of untrusted input in Dawn
• CVE-2026-14429: Insufficient validation of untrusted input in Skia
• CVE-2026-14430: Integer overflow in V8
• CVE-2026-14431: Type confusion in V8
• CVE-2026-14432: Use after free in V8
• CVE-2026-15107: Use after free in IndexedDB
• CVE-2026-15109: Uninitialized Use in ANGLE
• CVE-2026-15114: Out of bounds read and write in Codecs
• CVE-2026-15118: Use after free in Input
• CVE-2026-15119: Inappropriate implementation in GetUserMedia
• CVE-2026-15121: Use after free in WebRTC
• CVE-2026-15123: Insufficient data validation in DOM
• CVE-2026-15125: Inappropriate implementation / Use after free in Forms
• CVE-2026-15126: Inappropriate implementation / Use after free in Forms
• CVE-2026-15127: Inappropriate implementation in WebGL
• CVE-2026-15128: Inappropriate implementation / Use after free in Forms
• CVE-2026-15132: Uninitialized Use in V8
• CVE-2026-15133: Use after free in InterestGroups
• CVE-2026-15766: Uninitialized Use in Skia
• CVE-2026-15767: Heap buffer overflow in libyuv
• CVE-2026-15770: Uninitialized Use in V8
• CVE-2026-15771: Insufficient validation of untrusted input in Media
• CVE-2026-15772: Use after free in GPU
• CVE-2026-15773: Use after free in Core
• CVE-2026-15774: Use after free in Skia
• CVE-2026-15775: Insufficient policy enforcement in V8
• CVE-2026-15776: Type confusion in V8
• CVE-2026-15778: Insufficient validation of untrusted input in Navigation
• CVE-2026-15899: Use after free in CameraCapture
• CVE-2026-15900: Use after free in GPU
• CVE-2026-15901: Use after free in Network
• CVE-2026-15903: Out of bounds read and write in V8
• CVE-2026-15905: Use after free in Aura
• CVE-2026-16413: Out of bounds write in ANGLE
• CVE-2026-16417: Uninitialized Use in Skia
• CVE-2026-16418: Stack buffer overflow in V8
• CVE-2026-16419: Out of bounds read and write in ANGLE
• CVE-2026-16420: Type confusion in WebAudio/Inappropriate Implementation in WebAudio
• CVE-2026-16421: Type confusion in WebAudio/Inappropriate Implementation in WebAudio
• CVE-2026-16422: Insufficient validation of untrusted input in Certificate
• CVE-2026-16423: Use after free in UI
• CVE-2026-16424: Use after free in GPU
• CVE-2026-16804: Use after free in Input
• CVE-2026-16805: Use after free in Blink
• CVE-2026-16807: Out of bounds write in Codecs
• CVE-2026-17650: Use after free in Compositing
• CVE-2026-17651: Insufficient validation of untrusted input in Dawn
• CVE-2026-17653: Use after free in Skia
• CVE-2026-17657: Use after free in Navigation
• CVE-2026-17658: Use after free in V8
• CVE-2026-17659: Inappropriate implementation in SiteIsolation
• CVE-2026-17664: Insufficient validation of untrusted input in Loader
• CVE-2026-17665: Use after free in V8
• CVE-2026-17668: Uninitialized Use in ANGLE
• CVE-2026-17671: Insufficient validation of untrusted input in ANGLE
• CVE-2026-17673: Integer overflow in QUIC
• CVE-2026-17676: Inappropriate implementation in ANGLE
• CVE-2026-17689: Uninitialized Use in ANGLE
• CVE-2026-17691: Out of bounds write in ANGLE
• CVE-2026-17692: Use after free in DataTransfer
• CVE-2026-17695: Inappropriate implementation in ANGLE
• CVE-2026-17701: Out of bounds read in ANGLE
• CVE-2026-17702: Inappropriate implementation in Skia
• CVE-2026-17704: Use after free in ANGLE
• CVE-2026-17709: Race in Downloads
• CVE-2026-17710: Inappropriate implementation in MHTML
• CVE-2026-17713: Insufficient validation of untrusted input in Accessibility
• CVE-2026-17717: Integer overflow in ANGLE
• CVE-2026-17718: Use after free in ANGLE
• CVE-2026-17721: Out of bounds write in ANGLE
• CVE-2026-19140: Use after free in GPU
• CVE-2026-19141: Use after free in Resources
• CVE-2026-19146: Uninitialized Use in GPU
• CVE-2026-19147: Use after free in Aura
• CVE-2026-19148: Out of bounds write in GPU
• CVE-2026-19149: Use after free in Aura
• CVE-2026-19150: Inappropriate implementation in V8
• CVE-2026-19151: Use after free in V8
• CVE-2026-19152: Inappropriate implementation in Navigation
• CVE-2026-19153: Insufficient validation of untrusted input in Workers
• CVE-2026-19154: Use after free in Skia
• CVE-2026-19156: Heap buffer overflow in Base
• CVE-2026-19157: Out of bounds write in ANGLE
• CVE-2026-19160: Uninitialized Use in Skia
• CVE-2026-19161: Uninitialized Use in Skia
• CVE-2026-19162: Out of bounds write in V8
• CVE-2026-19163: Use after free in Media
• CVE-2026-19164: Insufficient validation of untrusted input in Codecs
• CVE-2026-19165: Use after free in Extensions
• CVE-2026-19167: Integer overflow in GPU
• CVE-2026-19168: Inappropriate implementation in V8
• CVE-2026-19172: Use after free in View
• CVE-2026-19174: Integer overflow in V8
• CVE-2026-19176: Use after free in Skia
• CVE-2026-25210: Integer overflow in XML

Chrome Releases reports:

This update includes 15 security fixes:

• [534923522] Critical CVE-2026-76034: Buffer overflow in WebGL.
• [540087398] Critical CVE-2026-76036: Buffer overflow in Dawn.
• [516715010] High CVE-2026-76033: Inappropriate implementation in CORS.
• [517612295] High CVE-2026-76037: Link following in CredentialProvider.
• [522732244] High CVE-2026-76044: Race condition in USB.
• [525167753] High CVE-2026-76039: Incorrect reference resolution in Core.
• [534862220] High CVE-2026-76040: Use after free in Browser.
• [536439844] High CVE-2026-76035: Inappropriate implementation in Media.
• [536460270] High CVE-2026-76042: Use of uninitialized resource in GPU.
• [536581050] High CVE-2026-76046: Buffer overflow in ANGLE.
• [539350801] High CVE-2026-76043: Incorrect calculation in V8.
• [540027341] High CVE-2026-76041: Information leak in Skia.
• [541251902] High CVE-2026-76047: Type confusion in V8.
• [541926503] High CVE-2026-76038: Type confusion in V8.
• [543082390] High CVE-2026-76045: Use after free in WebGL.

Tim Wojtulewicz of Corelight reports:

HIGH: SMB: Chains of AndX messages can crash Zeek

HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

HIGH: SIP: Memory exhaustion from long request/response paths

HIGH: DHCP: Memory exhaustion from retained options after analyzer violation

HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries

HIGH: SMB: DCE/RPC memory exhaustion from fragment state

HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory

HIGH: ZIP: Unbounded decompression

HIGH: Redis: Parsed Redis traffic memory exhaustion

HIGH: Invalid IPv6 fragments can lead to unbounded state growth

HIGH: SSH: Quadratic KEX algorithm CPU exhaustion

HIGH: NVT: Oversized line recovery writes before heap buffer

HIGH: DHCP: Unbounded state growth via join_data

HIGH: FTP: Unbounded state growth via ftp_data_expected

HIGH: OCSP: Empty byName responder ID crashes Zeek

HIGH: ARP: Tunneled ARP traffic crashes Zeek

HIGH: LDAP: Unbounded per-connection script state

HIGH: IRC DCC SEND has unbounded state growth

HIGH: tunnel_changed event limit bypass on direct/tunneled toggles

HIGH: Recursive stack exhaustion from deep packet analyzer chains

MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch

MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads

MEDIUM: NetBIOS: Memory exhaustion from declared session lengths

MEDIUM: IRC: Single DCC Send packet can result in scripting error

MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results

The Podman developers report:

When running podman quadlet install --replace to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved.

Gitlab reports:

Code Injection issue via GraphQL directive impacts GitLab CE/EE

Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE

Gitea reports

This release contains fixes for 45 security issues, including privilege escalation, remote denial of service, server-side request forgery, authorization and token scope bypasses, and information disclosure vulnerabilities. Please upgrade as soon as possible.

The PostgreSQL project reports:

CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands.

CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user.

CVE-2026-6470: Missing privilege check for type USAGE allows denial of service against ALTER and DROP of the type.

CVE-2026-6471: Logical decoding lets a REPLICATION- privileged user dlopen an arbitrary file via the decoding plugin choice, running arbitrary code as the server's OS user.

CVE-2026-14662: Integer wraparound in tsvector and tsquery functions can undersize an allocation, causing a buffer overflow and arbitrary code execution.

CVE-2026-14663: pgcrypto silently encrypts to and decrypts from cleartext for ciphers OpenSSL has disabled, letting an attacker recover cleartext.

CVE-2026-14664: Heap buffer overflow in the regexp engine allows arbitrary code execution via crafted input text.

CVE-2026-14666: Row-level security policy caching can retain a stale policy after role changes, letting a user complete now-forbidden reads or writes.

CVE-2026-14668: Type confusion in the ctid selectivity estimator discloses a derivative of an arbitrary 4-byte span of server memory.

CVE-2026-14669: Heap buffer overflow in to_char(timestamptz) via a long POSIX timezone abbreviation allows arbitrary code execution.

CVE-2026-14670: Heap buffer overflow in plperl, on return of a tied hash, allows the function owner to execute arbitrary code.

CVE-2026-14671: Type confusion in module "refint" allows an object creator to execute arbitrary code.

CVE-2026-14672: SCRAM authentication reveals whether a role exists via an observable difference in the reported iteration count.

CVE-2026-14673: amcheck fails to clear an untrusted search path, letting an EXECUTE grantee run arbitrary functions as an expression index's owner.

CVE-2026-14676: Heap buffer overflow in pg_stat_statements via crafted queries with array constants allows arbitrary code execution.

CVE-2026-14677: Integer wraparound in 32-bit pltcl/plperl builds can undersize an allocation, allowing arbitrary code execution.

CVE-2026-14678: pg_trgm's picksplit function reads past the end of a heap buffer, potentially disclosing limited memory.

CVE-2026-14679: Stack buffer overflow in argument-name matching lets an object creator write a few attacker- influenced bytes into server memory.

CVE-2026-14680: Type confusion via "internal"-typed function arguments allows any user to execute arbitrary code.

CVE-2026-14681: GSSAPI encryption is not properly enforced when coupled with an initial direct SSL connection.

CVE-2026-15741: Expression deparse of EXTRACT() allows SQL injection via a hostile object definition, affecting pg_dump and psql.

CVE-2026-15742: Integer wraparound in fuzzystrmatch's levenshtein() functions allows writes to arbitrary addresses and code execution.

CVE-2026-16238: Type confusion in pg_restore_attribute_stats() allows arbitrary code execution via conflated range/multirange values.

CVE-2026-16239: Type confusion via cursor DECLARE and CLOSE allows a user to execute arbitrary code.

CVE-2026-16241: Integer underflow in ECPG can crash the client via a bytea value lacking its mandatory prefix.

CVE-2026-18024: The ascii() function reads past the end of a buffer, disclosing a few bytes of server memory.

CVE-2026-18408: psql's \unrestrict lets a malicious pg_dump origin-server superuser execute arbitrary code in the restoring client.

CVE-2026-19385: Heap buffer overflow in pg_dump, when dumping long function transform lists, allows arbitrary code execution.

Cary Phillips reports:

[The OpenEXR 3.4.14] release addresses the following security vulnerabilities:

• CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
• CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow
• CVE-2026-62986: PyOpenEXR deep prefixed RGB stale lane disclosure
• CVE-2026-61703: PyOpenEXR deep mixed RGB heap buffer overflow
• CVE-2026-61555: empty multiView viewFromChannelName file crash
• CVE-2026-59985: ILP32 OpenEXRCore RLE decode heap OOB read DoS
• CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow
• CVE-2026-59983: ILP32 DeepTiledInputFile sample count table decode OOB read
• CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow
• CVE-2026-59981: OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
• CVE-2026-59189: OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
• CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow
• CVE-2026-59186: OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
• CVE-2026-59184: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
• CVE-2026-59183: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding

Gitlab reports:

Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE

Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab

Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE

Authorization Bypass issue in Duo Workflow Service impacts GitLab EE

Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/E

Missing Authorization issue in ProjectsController impacts GitLab EE

Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EE

Missing Authorization issue in merge requests API impacts GitLab EE

Missing Authorization issue in external status check API impacts GitLab EE

Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EE

Missing Authorization issue in GitLab Duo settings page impacts GitLab EE

Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EE

Incorrect Privilege Assignment issue in custom roles impacts GitLab EE

Chrome Releases reports:

This update includes 5 security fixes:

• [535000102] High CVE-2026-19556: Use after free in V8.
• [534867485] High CVE-2026-19557: Use after free in TabStrip.
• [536676756] High CVE-2026-19558: Use after free in Extensions.
• [540100588] High CVE-2026-19559: Use after free in HTML.
• [540482895] High CVE-2026-19560: Use after free in Blink.

Chrome Releases reports:

This update includes 41 security fixes:

• [499602793] Critical CVE-2026-19137: Use after free in WebGL.
• [524824288] Critical CVE-2026-19149: Use after free in ura.
• [532941869] Critical CVE-2026-19154: Use after free in Skia.
• [534903095] Critical CVE-2026-19157: Out of bounds write in GLE.
• [537729021] Critical CVE-2026-19170: Use after free in WebGL.
• [537838324] Critical CVE-2026-19172: Use after free in Views.
• [537390933] High CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks.
• [536945254] High CVE-2026-19168: Inappropriate implementation in V8.
• [500097298] High CVE-2026-19138: Heap buffer overflow in CrashReporting.
• [511731805] High CVE-2026-19139: Race in CredentialProvider.
• [513044017] High CVE-2026-19140: Use after free in GPU.
• [513602949] High CVE-2026-19141: Use after free in Resources.
• [515428251] High CVE-2026-19142: Use after free in Views.
• [517772612] High CVE-2026-19143: Insufficient validation of untrusted input in WebPKs.
• [520167277] High CVE-2026-19144: Use after free in HTML.
• [521878431] High CVE-2026-19145: Use after free in Translate.
• [523713150] High CVE-2026-19146: Uninitialized Use in GPU.
• [524439798] High CVE-2026-19147: Use after free in ura.
• [524460000] High CVE-2026-19148: Out of bounds write in GPU.
• [526380803] High CVE-2026-19150: Inappropriate implementation in V8.
• [530663440] High CVE-2026-19151: Use after free in V8.
• [531165110] High CVE-2026-19152: Inappropriate implementation in avigation.
• [532939327] High CVE-2026-19153: Insufficient validation of untrusted input in Workers.
• [533053621] High CVE-2026-19155: Use after free in Payments.
• [533331920] High CVE-2026-19156: Heap buffer overflow in Base.
• [535749174] High CVE-2026-19158: Use after free in Views.
• [536067175] High CVE-2026-19159: Use after free in Views.
• [536068737] High CVE-2026-19160: Uninitialized Use in Skia.
• [536165038] High CVE-2026-19161: Uninitialized Use in Skia.
• [536271629] High CVE-2026-19162: Out of bounds write in V8.
• [536449742] High CVE-2026-19163: Use after free in Media.
• [536470854] High CVE-2026-19164: Insufficient validation of untrusted input in Codecs.
• [536512612] High CVE-2026-19165: Use after free in Extensions.
• [536584251] High CVE-2026-19166: Use after free in Web uthentication.
• [536666274] High CVE-2026-19167: Integer overflow in GPU.
• [537832446] High CVE-2026-19171: Use after free in Media.
• [538332338] High CVE-2026-19173: Out of bounds write in Skia.
• [538378084] High CVE-2026-19174: Integer overflow in V8.
• [540138836] High CVE-2026-19175: Use after free in Payments.
• [540157141] High CVE-2026-19176: Use after free in Skia.
• [540289900] High CVE-2026-19177: Insufficient validation of untrusted input in UI.

phpMyFAQ team reports:

The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim.

The brute-force throttle protecting the administration two-factor prompt is scoped to the session. An attacker who starts with a fresh cookie jar resets the counter and can guess TOTP codes without any effective rate limit.

An LDAP login silently reactivates a local account that an administrator has blocked, and the state change is not written to the audit log, so a revoked user regains access unnoticed.

The remember-me cookie is issued before the second factor has been verified. An attacker who knows only the password can keep the cookie from the incomplete login and use it to return as the fully authenticated user, bypassing two-factor authentication.

Glossary input is escaped before it is truncated. Truncation can cut an escape sequence in half, which allows an authenticated user to inject SQL into the resulting query.

A tracking file below the document root is served without authentication and contains password reset tokens, allowing an unauthenticated visitor to take over the accounts those tokens belong to.

The public PDF export does not check whether a FAQ record is active, so an unauthenticated visitor can retrieve the title and solution of drafts and unpublished entries.

Comment endpoints do not verify authorization for the parent FAQ record, exposing the comments, the personal data of the commenters, and attachment metadata of restricted records.

The PostgreSQL search backend declares the wrong LIKE ESCAPE character, which makes the wildcard-escaping fix ineffective on that backend.

The administration API endpoints that read the LDAP, Elasticsearch, OpenSearcr, and dashboard configuration only require a login instead of the CONFIGURATION_EDIT permission, so any authenticated user can read these settings.

An authenticated FAQ editor can reference a local file as an image in a FAQ entry and have the PDF export embed and disclose its contents.

The registration endpoints remain reachable even when security.enableRegistration is turned off, so visitors can still create accounts on an installation that is meant to be closed.

The content backup is written as a ZIP archive into the web-accessible document root, where anyone who guesses or learns its name can download the full contents of the installation.

The backup, database migration, and maintenance mode endpoints can be reached without authentication, allowing an unauthenticated attacker to export data or put the installation into maintenance mode.

Gitea reports

This release addresses the following security vulnerabilities. Please upgrade as soon as possible.

Unauthenticated arbitrary file read via the Org-mode #INCLUDE directive.

Remote code execution via the diffpatch API through Git hook installation.

Google has released Chrome 151.0.7922.109 to address multiple critical vulnerabilities.

CVE-2026-19172: Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19170: Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19157: Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19154: Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19149: Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19137: Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

The OpenSSH project reports:

• ssh-agent(1): fix an interaction between agent locking and the session-bind@openssh.com extension that is used to identify forwarded agents.
• ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server.
• sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default).

The Calibre Web Team reports:

ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login.
This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.
This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

The Roundcube project reports:

• >Missing basic validation for content proxied by the css proxy
• SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
• SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
• remote content blocking bypass via unclosed url() in a FuncIRI attribute
• LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
• arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
• RCE via cmd_learn driver of markasjunk plugin
• Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
• password’s modoboa driver leak of an authentication token to a user-controlled host
• stored XSS in “Add to address book” action
• HTML/CSS sanitization bypass via SVG animate by attribute

The GStreamer project reports:

Multiple security issues were identified and fixed in the GStreamer framework.

• GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder
• GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader
• GStreamer-SA-2026-0069: Heap buffer overflow in FFmpeg demuxer wrapper
• GStreamer-SA-2026-0070: Out-of bounds write in H.265/HEVC parser short-term RPS parsing
• GStreamer-SA-2026-0071: Heap buffer overflow in DVD subpicture decoder
• GStreamer-SA-2026-0072: Multiple out-of-bounds reads, out-of-bounds writes, and integer overflow vulnerabilities in the AVI demuxer
• GStreamer-SA-2026-0073: Out-of-bounds read in Matroska demuxer FLAC header parser
• GStreamer-SA-2026-0075: Integer overflow and underflow in ASF demuxer bounds checks
• GStreamer-SA-2026-0076: Unbounded memory growth in H.264/H.265 RTP depayloaders during fragmented NAL unit reassembly
• GStreamer-SA-2026-0077: Heap out-of-bounds write in IMA ADPCM audio decoder

Zhixi "Jace" Sun, independent security researcher reports:

• CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow
• CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write

CVE-2026-52682: A crafted DNS packet can cause increased memory and CPU consumption.