Threat database

CVE-2026-106376 is a medium severity vulnerability in Google Chrome on Windows prior to version 155.0.8059.39. It involves an uninitialized resource in ANGLE that allows a remote attacker to read memory outside the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 4.7 and does not require privileges but does require user interaction. A fix is available in Chrome version 155.0.8059.39.

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106366 is a vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incomplete cleanup in the CustomTabs feature, which allows a remote attacker to bypass the web origin policy using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability has a high severity rating and affects Chrome desktop versions before 155.0.8059.39.

Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106347 is a use-after-free vulnerability in the Track component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The vulnerability is rated with a high severity CVSS score of 8.8. Google has released an update to address this issue.

CVE-2026-106358 is a critical use-after-free vulnerability in the Navigation component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-106382 is a critical use-after-free vulnerability in the Chromecast component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

A SQL injection vulnerability exists in SourceCodester Performance Indicator System 1.0 in the /opils/admin/view_product.php file via manipulation of the Category argument. This vulnerability allows remote attackers with low privileges to execute unauthorized SQL commands. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no active exploitation in the wild has been confirmed. No patch or remediation information is provided.

JetBrains TeamCity versions before 2026.2.1 contain a vulnerability where missing validation of Git submodule URLs allows an attacker with limited privileges to read local repositories on the server. This issue is identified as CVE-2026-106219 and has a medium severity with a CVSS score of 6.5. The vulnerability does not impact integrity or availability but allows unauthorized disclosure of local repository contents.

A vulnerability in JetBrains TeamCity before versions 2026.1.3 and 2025.11.7 allows a Kotlin DSL sandbox escape that can lead to remote code execution (RCE) on the server. This flaw enables an attacker with limited privileges to execute arbitrary code on the affected server without user interaction.

Bludit CMS version 3.22.0 contains a vulnerability that allows a remote attacker with high privileges to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. The vulnerability does not require user interaction but requires privileges. The impact is limited to confidentiality without affecting integrity or availability.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain an improper certificate validation vulnerability in the proxy-server component. This flaw could allow an unauthenticated attacker on an adjacent network to exploit the vulnerability, potentially exposing storage backend administrator credentials. The vulnerability has a high severity rating with a CVSS score of 8.2.

A cross-site scripting (XSS) vulnerability exists in getformwork formwork up to version 2.3.12 in the DomSanitizer::sanitizeNodeAttribute function within the URI Sanitizer component. This vulnerability allows remote attackers to manipulate the formaction argument, potentially leading to XSS attacks. The issue is addressed by upgrading to version 2.3.13.

Dell System Update versions prior to 2.3.0.0 contain an improper access control vulnerability (CWE-284) that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability has a high severity with a CVSS score of 8.2. Exploitation requires local access and user interaction. No known exploits in the wild have been reported. No official patch or remediation details are provided in the available data.

Dell System Update versions prior to 2.3.0.0 contain an incorrect permission assignment vulnerability that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability is identified as CWE-732 and has a high severity rating with a CVSS score of 8.2. Exploitation requires local access and user interaction. No patch information is currently provided.