Threat database

A use-after-free vulnerability exists in the Network component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by sending crafted network traffic. The vulnerability is rated critical with a CVSS score of 9.6.

A use-after-free vulnerability exists in the PDF component of Google Chrome versions prior to 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has a critical severity rating and a CVSS score of 9.6.

CVE-2026-110149 is a critical use-after-free vulnerability in the browser component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Google has released an update to fix this issue in version 155.0.8059.79.

A critical buffer overflow vulnerability exists in the ANGLE component of Google Chrome on Android versions prior to 155.0.8059.79. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

A security update for the rhc-worker-playbook component in Red Hat Enterprise Linux addresses a local privilege escalation vulnerability in the ansible.posix authorized_key module. The issue involves symlink-following during a chown operation, which could allow unauthorized privilege escalation. The update is rated as Important by Red Hat and affects Red Hat Enterprise Linux 8.8 variants. No CVSS score is provided for this vulnerability.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects multiple versions up to 16.0.7 and 15.1.8. No patch or remediation details are provided in the input data.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 16.0.7 and 15.1.8. The CVSS v3.1 base score is 7.8, indicating high severity.

Adobe Bridge contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects multiple versions up to 16.0.7 and 15.1.8. The CVSS 3.1 base score is 5.5, indicating medium severity. No known exploits are reported in the wild, and no patch information is provided.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 16.0.7 and 15.1.8. The CVSS 3.1 base score is 7.8, indicating a high severity issue.

Microsoft's October 2026 Patch Tuesday includes security updates addressing 1415 vulnerabilities across multiple products, with 85 marked as critical. Among these, 67 are remote code execution vulnerabilities. One vulnerability, CVE-2026-96951, a security feature bypass in Windows Shell involving command injection, has been exploited in the wild. Other notable vulnerabilities affect Windows Active Directory Domain Services, Microsoft Exchange Server, Windows Hyper-V, Microsoft Office Excel, Microsoft QUIC, and various Windows components. The vulnerabilities have CVSS base scores ranging from 7.0 to 9.8, indicating high severity. Microsoft has released patches for these issues as part of the monthly update cycle.

Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.

Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.