Chromium: CVE-2026-7899 Out of bounds read and write in V8

Chromium: CVE-2026-7898 Use after free in Chromoting

Chromium: CVE-2026-7897 Use after free in Mobile

Chromium: CVE-2026-7896 Integer overflow in Blink

Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

libssh2 userauth.c userauth_password integer overflow

Signed integer overflow in metaphone()

iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined

Use-after-free in PQC hybrid key-share handling

PKCS7_verify signer confusion allows forged signatures to be accepted

Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

NULL pointer dereference in SOAP apache:Map decoder with missing <value>

SoapServer session-persisted object use-after-free via SOAP header fault

Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

Out-of-bounds read in urldecode() on NetBSD

Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

cross-proxy Digest auth state leak