New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Entity Reference Manager (Merge entities): Incorrect authorization in merge function

The Drupal contrib module Entity Reference Manager (Merge entities) up to version 1.0.3 (exclusive) contains an incorrect authorization flaw that allows forceful browsing. According to the Drupal advisory SA-CONTRIB-2026-194, users who can view content can reach the entity merge function and delete nodes, taxonomy terms or media entities. The CVSS score of 6.5 is based on NVD's preliminary analysis and may understate the impact.

Drupal · Entity Reference Manager (Merge entities)

Research and translation in progress – available shortly.

Drupal Block AJAX: PHP object injection via unvalidated block data

The Drupal contrib module Block AJAX (block_ajax) does not sufficiently validate user-supplied data it uses to construct a block. In the worst case, this can lead to PHP object injection and remote code execution. According to Drupal, the issue only affects sites with Layout Builder enabled or another block plugin that handles the data unsafely; the authentication requirements are not yet confirmed.

Drupal · Block AJAX

Undertow: HTTP request smuggling via chunk-size overflow in ChunkReader

A flaw in the ChunkReader component of the Undertow web server, which handles chunked transfer encoding, allows a crafted 15-digit chunk size to bypass the size check. An attacker can make the server end a request body early and treat the remaining data as a second, smuggled request. Exploitation requires specific TCP segmentation control, and the CVSS score is 6.5 (Medium). Red Hat rates the issue Moderate.

Red Hat · Undertow

Graphics DDK: Out-of-bounds write in GPU GLES user-space library

Imagination's Graphics DDK, a GPU driver development kit, contains an out-of-bounds read and/or write in the GPU GLES user-space shared library. A web page with unusual WebGPU content loaded into the GPU render process can trigger it and crash that process. On certain platforms where the graphics process runs with system privileges, this could enable further exploits on the device. The CVSS vector should be verified with the vendor before relying on the score.

Imagination Technologies · Graphics DDK

Imagination Graphics DDK: Integer truncation limits GPU buffer mapping

A kernel-mode GPU driver bug in the Imagination Graphics DDK (PowerVR) causes integer truncation when mapping GPU buffer pages in the 0 to 4 GB range. This produces mapping errors and limits driver functionality, and it appears on systems where the fix for CVE-2026-49746 is applied. The sources describe functional breakage rather than code execution or data disclosure, and the CVSS score of 9.8 in the request is not supported by the sources.

Imagination Technologies · Graphics DDK

Research and translation in progress – available shortly.

Imagination Graphics DDK: Use-after-free in GPU driver allows memory access

A use-after-free flaw in the Imagination Graphics DDK lets a buffer shared by the CPU driver and GPU firmware be freed while still in use. Local software running as a non-privileged user can reallocate that memory and tamper with the driver's page address list, so the GPU can read or write physical memory it should not access. Exploitation requires local code execution; no user interaction is needed.

Imagination Technologies · Graphics DDK

Imagination Graphics DDK: Stack buffer overflow in kernel GPU driver

The Imagination Technologies Graphics DDK, the driver development kit for PowerVR GPUs on Linux and Android, contains a stack-based buffer overflow in the kernel. The overflow occurs when resolved Linux/Android fence checkpoints are processed, because user checkpoints are excluded from the undersized stack array. A local user with low privileges can trigger it through improper GPU system calls, which can corrupt kernel memory and typically leads to a kernel crash (denial of service).

Imagination Technologies · Graphics DDK

Imagination Graphics DDK: Integer overflow leading to kernel memory disclosure

Software running as a non-privileged user on devices with Imagination PowerVR GPUs can trigger an integer overflow in the kernel-mode driver of the Graphics DDK during memory allocation. This leads to an undersized kernel buffer, which may allow an attacker to map physical pages into a controlled GPU MMU context and read sensitive kernel data. The attacker needs local code execution with low privileges, so the flaw is not reachable remotely. The severity is disputed: 7.1 as provided, 8.8 according to VulDB.

Imagination Technologies · Graphics DDK

Imagination Graphics DDK: Null pointer dereference in shader compiler (libusc)

A web page with crafted GPU shader code can trigger an integer overflow in the libusc shader compiler of Imagination Graphics DDK. The overflow leads to a failed memory allocation and a NULL pointer dereference, which crashes the compiler process. On certain platforms where the compiler runs with system privileges, the flaw could also enable further exploits on the device.

Imagination Technologies · Graphics DDK

Imagination Graphics DDK: Use-after-free in hardware performance counter stream closure

A race condition in the destruction path of the hardware performance counter buffer in the Imagination Graphics DDK (PowerVR GPU driver) can cause a reference counter to be decremented non-atomically. Software running as a non-privileged user on an affected device can trigger a use-after-free (CWE-416), which may allow reading and writing of kernel heap memory. Exploitation requires local code execution on the device, so an attacker needs a foothold first.

Imagination Technologies · Graphics DDK

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Google Chrome: Incorrect authorization in Input bypasses web origin policy

Google Chrome for desktop prior to 156.0.8078.79 contains an incorrect authorization flaw in the Input component. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page, which requires social engineering. The official CVE record rates the impact as high (CVSS 8.8), but the Chrome release notes describe the flaw as a use-after-free, so the description should be verified against NVD and the vendor advisory.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem

A flaw in the FileSystem component of Google Chrome before 156.0.8078.79 may allow a remote attacker to potentially execute arbitrary code. The CVE data describes incorrect authorization (CWE-863) that could allow code execution outside the sandbox, and it requires a user to open a crafted HTML page after social engineering. Sources disagree on the description, CWE and CVSS score (some trackers list memory corruption, CWE-119, code execution inside the sandbox and CVSS 6.3), so the exact impact must be verified against the NVD record.

Google · Chrome

Google Chrome: Improper input validation in Network

Google Chrome before 156.0.8078.79 contains an improper input validation flaw in its Network component (CVE-2026-76029, rated High by Chromium). According to the CVE text, a remote attacker can execute arbitrary code inside the browser sandbox by sending crafted network traffic. Other sources describe a memory corruption flaw triggered by a crafted HTML page, so the exact conditions and the CVSS score of 8.8 must be verified against the NVD entry.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in its FileSystem component (CWE-863 in the CVE record). A remote attacker who lures a user to a crafted HTML page can, with social engineering, execute arbitrary code outside the sandbox. The CVE record rates it High (CVSS 8.8), but other sources differ on the bug class and score, so the vendor fix should be applied regardless.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Origin validation error in Autofill

Google Chrome prior to 156.0.8078.79 contains an origin validation error in its Autofill feature (CWE-346, CVSS 8.8 per the supplied data). A remote attacker can use a crafted HTML page to bypass the web origin policy, and the victim must open that page. Secondary sources describe this issue as a memory corruption bug (CWE-119, VulDB CVSS 6.3), and the NVD record was still pending, so the details should be verified.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome prior to 156.0.8078.79 contains an incorrect authorization flaw in the FileSystem component. A remote attacker can use social engineering and a crafted HTML page to execute arbitrary code outside the browser sandbox. The attack requires the victim to visit the malicious page.

Google · Chrome