Analysis

CVE-2026-13792 is a use-after-free flaw (CWE-416) in the Touch Bar component of Google Chrome on Mac, described as affecting versions prior to 150.0.7871.47. According to the record, a remote attacker could potentially escape the browser sandbox through a crafted HTML page, and the CVSS 3.1 base score is 9.6 (critical). The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

SAP has published CVE-2026-34260, a critical SQL injection flaw in SAP S/4HANA (SAP Enterprise Search for ABAP) that an authenticated user can trigger through user-controlled input. The CNA score is 9.6 under CVSS 3.1, with high impact on confidentiality and availability and no integrity impact. The record lists no affected or fixed versions, so administrators should consult the SAP references to confirm applicability and patch status.

A use-after-free flaw in the USB component of Google Chrome on Mac, prior to 150.0.7871.47, could let a remote attacker who had already compromised the renderer process attempt a sandbox escape through a crafted HTML page. The record lists a CVSS 3.1 base score of 9.6 and notes that Chromium rates the issue High. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-13934 affects Dawn, a component of Google Chrome on Android before 150.0.7871.47. A remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The CVSS 3.1 base score of 9.6 is critical, and the record shows no KEV listing or confirmed active exploitation.

CVE-2026-41901 affects Thymeleaf, a server-side Java template engine, prior to 3.1.5.RELEASE. The record describes a security bypass in expression execution that can enable Server-Side Template Injection when unsanitized values are used in sandboxed template contexts. The GitHub advisory rates it critical with CVSS 3.1 score 9.0, and the record states it is fixed in 3.1.5.RELEASE.

CVE-2020-37168 affects Ecommerce Systempay 1.0 and is classified as CWE-328 in the record. According to the description, the 16-character production secret key used to sign payment data can be recovered by brute force, which could allow forged payment signatures and altered transaction amounts. The record reports CVSS 3.1 9.8 (Critical) and CVSS 4.0 9.3, and no confirmed exploitation in CISA KEV.

Google Cloud AlloyDB for PostgreSQL clusters created through Terraform or the REST API before 2025-11-03 could receive an insecure default administrative password. The record lists a CVSS 4.0 score of 9.2 (critical), and no confirmed exploitation appears in the sources consulted. Operators should verify and rotate administrative credentials on any affected clusters.

obsidian-tc versions before 1.3.1 let any valid token select another configured vault through the input.vault value and read, write or delete its contents via affected tools. The CNA rates the issue critical with a CVSS 3.1 base score of 9.9, and the record identifies 1.3.1 as the fixed version. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-13878 is a use-after-free flaw in the Bluetooth component of Google Chrome on Mac, described as allowing a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The record lists a CVSS score of 9.6, and the affected range indicates that versions before 150.0.7871.47 are impacted. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-13780 is an insufficient input validation issue in ANGLE, the graphics component of Google Chrome, affecting builds prior to 150.0.7871.47. The record describes a sandbox escape that requires an attacker who has already compromised the renderer process and a crafted HTML page. The NVD and CISA-ADP scores are 9.6 (CVSS 3.1), but no confirmed exploitation appears in the consulted sources.

CVE-2026-13785 is a use-after-free flaw in the Bluetooth component of Google Chrome on macOS, classified as CWE-416. The record says a remote attacker could potentially escape the sandbox through a crafted HTML page if a user is persuaded to perform specific UI gestures. NVD assigns CVSS 3.1 9.6, and no confirmed exploitation appears in the sources consulted.

A use-after-free flaw (CWE-416) in the Device component of Google Chrome on Windows is described as enabling a sandbox escape by an attacker who has already compromised the renderer process. The record lists versions prior to 150.0.7871.47 as affected and reports a CVSS 3.1 base score of 9.6. The sources consulted show no confirmed exploitation, and the CVE is not listed in CISA KEV.

CVE-2026-65162 affects NVIDIA AIStore for Linux and concerns a legacy ETL Kubernetes PodSpec initialization API that can accept host-namespace and container-security settings from a remote party. The CVE record rates it critical with a CVSS 3.1 base score of 10, and no fixed version is listed in the sources reviewed. No confirmed exploitation in the wild appears in the consulted sources.

CVE-2026-43900 is a critical cross-site scripting flaw in DeepChat, an open-source AI agent platform, affecting versions before v1.0.4-beta.1. The SVG sanitizer removes javascript: protocols with plain-text regular expressions and does not account for HTML entity decoding before Vue's v-html rendering. The advisory says it is fixed in v1.0.4-beta.1, and the sources consulted show no confirmed exploitation.

DBIx::QuickORM for Perl, in versions before 0.000026, can allow SQL injection because caller-supplied SQL identifiers reach the generated SQL without quoting. The record rates it critical, with a CVSS 3.1 base score of 9.8, and maps it to CWE-89. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.