CVE-2026-11090
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa
CVSS
6.5
Medium
EPSS
0.3%
p16
KEV
—
Exploit Today
5
0-100
Published: Jun 4, 2026 · Last modified: Jul 23, 2026 · CWE-457 · CWE-125 · CWE-787
0.3%EPSS · 30 days0.3%
2026-07-312026-08-28
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-823306.1 MED—
——0A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.23hCVE-2026-823286.1 MED—
——0A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.23hCVE-2026-823246.1 MED—
——0A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.1dCVE-2026-58106——
——0CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper.
At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size
passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the
destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a
2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.23hCVE-2026-400154.3 MED—
——0An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.1dCVE-2026-183935.4 MED—
——0A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond
the bounds of a heap-allocated buffer when processing crafted TDSC cursor
data. A remote attacker could exploit this by supplying a specially crafted
video file, potentially leading to a denial of service or arbitrary code
execution.23h