CVE-2026-13782

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-40141

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited pr

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-40139

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, i

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14104

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

▸ DO  Remote code execution — patch the affected products on priority.

CVE-2026-13776

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-8452

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-13775

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-8655

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2017-17674

BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code ex

▸ DO  Remote code execution — patch the affected products on priority.

CVE-2026-14106

Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-13781

Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-13780

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-13785

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14120

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14109

Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14101

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-41106

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-9074

IBM API Connect versions 10.0.8.0–10.0.8.9 and 12.1.0.0–12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-11720

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14537

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-14529

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-12569

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10523

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-34691

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-47928

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10990

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10931

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10966

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-11113

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10971

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-11002

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-11029

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10972

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-48567

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-11120

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2026-10974

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2025-41276

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2025-41275

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2025-41274

▸ DO  Critical severity — schedule patching of the affected products.

CVE-2025-41273

▸ DO  Critical severity — schedule patching of the affected products.