CVE-2026-8586

chromium-browser: chromium-browser: Inappropriate implementation in Chromoting

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-46356

Fleet: IP spoofing allows bypassing API rate limiting

Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fleetdm

Products

Fleet

CVE-2026-6402

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webpack.js

Products

Webpack-dev-server

CVE-2024-36333

Privilege Escalation via DLL Hijacking in AMD Cleanup Utility

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Amd Cleanup Utility Cleanup Utility Radeon Pro Vii and 26 more

CVE-2026-41520

Cillium exposes sensitive information included in the cilium-bugtool debug archive

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Cilium

Products

Cilium

CVE-2026-41895

changedetection.io: XXE vulnerability in the changedetection.io project

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon Webtechnologies

Products

Changedetection.io Changedetection

CVE-2026-44302

Snappier: Infinite loop in SnappyStream decompression on malformed framed input

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Brantburnett

Products

Snappier

CVE-2026-42544

Granian: Unauthenticated DoS via WebSocket subprotocol header panic

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Emmett-framework

Products

Granian

CVE-2026-8704

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Timlegge

Products

Crypt::dsa

CVE-2026-6637

PostgreSQL refint allows stack buffer overflow and SQL injection

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6575

PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6495

Ajax Load More < 7.8.4 - Reflected XSS

The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ajax Load More Wordpress

Products

Ajax Load More Wordpress

CVE-2026-6479

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-8700

Crypt::DSA versions before 1.20 for Perl generate seeds using rand

Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Timlegge

Products

Crypt::dsa

CVE-2026-6476

PostgreSQL pg_createsubscriber allows SQL injection via subscription name

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6475

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-46474

Trog::TOTP versions before 1.006 for Perl generate secrets using rand

Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Teodesian

Products

Trog::totp

CVE-2026-6474

PostgreSQL timeofday() can disclose portions of server memory

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6472

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-28376

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana