Threat database

CVE-2026-106439 is a high-severity vulnerability in hydra-ecosystem's hydra affecting versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through 1.4.0.dev9. It involves unsafe reflection where mutable module-level state used for target blocklists can be manipulated via configuration to remove blocked targets and instantiate them, bypassing intended execution restrictions. The vulnerability affects the legacy/default path without an execution whitelist and allows a configuration controlling multiple sibling _target_ entries to mutate the blocklist and invoke otherwise blocked targets. The issue is fixed in hydra-core 1.3.7 and 1.4.0.dev10. Users are advised to upgrade and avoid passing untrusted configuration to instantiate().

CVE-2026-106512 is a high-severity vulnerability in the MISP sachertortephp component where the CakeResponse::download() method improperly sanitizes filenames used in the Content-Disposition HTTP header. This flaw allows an authenticated user to craft filenames that inject HTTP header content, leading to stored cross-site scripting (XSS) when other users view affected pages. The vulnerability arises from two injection vectors: control characters causing header omission and double-quote characters enabling header parameter injection. Exploitation can result in session hijacking, data exfiltration, and unauthorized actions within the application context.

Dell Command | Configure (DCC) versions prior to 5.2.3.35 have a vulnerability where passwords are stored in plaintext. This flaw allows a low privileged local attacker to potentially access sensitive password information, leading to information disclosure. The vulnerability does not impact integrity or availability but poses a confidentiality risk. The CVSS score is 5.5, indicating a medium severity level.

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

CVE-2026-106355 is a medium severity vulnerability in Google Chrome's Media component on Windows. It involves missing authorization that allows a remote attacker, who has compromised the renderer process, to obtain sensitive information via a crafted HTML page. The vulnerability affects versions prior to 155.0.8059.39. The CVSS score is 5.3, indicating a moderate impact on confidentiality without affecting integrity or availability.

CVE-2026-106272 is a UI misrepresentation vulnerability in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39. It allows a remote attacker to potentially spoof UI elements by leveraging social engineering and crafted network traffic. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106345 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving use of a released resource in the Session component. This flaw allows a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.2 (medium severity).

Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

A UI misrepresentation vulnerability exists in the Chromoting component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The vulnerability has a medium severity rating with a CVSS score of 5.4. Google has released a stable channel update addressing this issue.

A UI misrepresentation vulnerability exists in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The vulnerability is rated as medium severity with a CVSS score of 5.4. Google has released an update to address this issue.

CVE-2026-106334 is a high severity information leak vulnerability in the Payments component of Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability requires user interaction and affects confidentiality, integrity, and availability.

CVE-2026-106294 is a critical vulnerability in Google Chrome on Mac platforms prior to version 155.0.8059.39. It involves incomplete cleanup in the Chromoting component, which allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The vulnerability has a high CVSS score of 9.1, indicating critical severity with high confidentiality impact and high availability impact. The issue affects versions before 155.0.8059.39 and has been addressed in that version.

A vulnerability in Google Chrome's SanitizerAPI prior to version 155.0.8059.39 allows a remote attacker to leak sensitive information via a crafted HTML page. The issue is classified with a low security severity by Chromium and has a CVSS score of 4.3, indicating a medium severity level overall.

CVE-2026-106325 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving incorrect reference resolution in the browser's core. This flaw allows a remote attacker, using social engineering, to leak cross-origin data through a crafted HTML page. The vulnerability has a low Chromium security severity and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. A stable channel update addressing this issue has been released by Google.

A race condition vulnerability exists in the Chromoting component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker, using social engineering and crafted network traffic, to potentially bypass system access restrictions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A UI misrepresentation vulnerability exists in the Chromoting feature of Google Chrome on Mac platforms prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The issue has a medium severity rating with a CVSS score of 5.4. Google has released an update to address this vulnerability.

CVE-2026-106195 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The vulnerability has a critical severity rating with a CVSS score of 9.1. Google has released a stable channel update addressing this issue.

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106339 is a low severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves use of a released resource in the browser's core, which could allow a remote attacker who has compromised the renderer process to potentially access cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 3.1, indicating low impact. Google has released a stable channel update addressing this issue.