Analysis

CVE-2026-13797 is an improper input validation flaw (CWE-20) in the Chromecast component of Google Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CNA rates it CVSS 3.1 9.6 (Critical), and no confirmed exploitation appears in the sources consulted.

CVE-2026-45091 affects the enterprise mode of sealed-env, a secret management library for Node.js and Java/Spring Boot. Versions 0.1.0-alpha.1 through 0.1.0-alpha.3 placed the operator's literal TOTP secret inside the JWS payload of every unseal token, and that payload is base64-encoded, not encrypted. The record reports a fix in 0.1.0-alpha.4 and a CVSS 3.1 score of 9.1 from the GitHub CNA.

IBM has disclosed a path traversal weakness (CWE-22) in DataStage on Cloud Pak for Data version 5.4.0.0. The record describes improper pathname validation that could let a remote authenticated attacker execute arbitrary code, with a reported CVSS 3.1 score of 9.6. No KEV listing or confirmed exploitation appears in the sources consulted.

Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints, where connections without a token parameter were treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could read or modify document contents. The record states the issue is fixed in 0.9.7.

CVE-2026-42196 is a path traversal weakness (CWE-22) in S3FileMiddleware of django-s3file, a file upload library for Django and Amazon S3, in versions prior to 7.0.2. The GitHub CNA rated it 9.9 critical under CVSS v4.0, and the record states the issue is fixed in 7.0.2. No confirmed exploitation appears in the sources consulted, and the record does not show a CISA KEV listing.

CVE-2026-13883 is a type confusion flaw in the ANGLE graphics component of Google Chrome, reported as allowing a remote attacker to potentially escape the sandbox through a crafted HTML page. The record assigns a CVSS 3.1 base score of 9.6 (critical) and states that Chromium rates the issue as Medium security severity. No confirmed exploitation appears in the sources consulted.

CVE-2026-13901 affects Google Chrome versions prior to 150.0.7871.47. The record describes insufficient policy enforcement in the Serial component that could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox through a crafted HTML page. No confirmed exploitation appears in the sources consulted.

A use-after-free flaw in the GPU component of Google Chrome before 150.0.7871.47 could let a remote attacker who had already compromised the renderer attempt a sandbox escape through a crafted HTML page. The record rates the issue critical with CVSS 3.1 base score 9.6, while Chromium rates its security severity as High. No confirmed exploitation appears in the sources consulted, and the record shows no KEV listing.

CVE-2026-85947 is a critical authorization flaw (CWE-269) in certain forest-management operations of Progress MarkLogic Server. The record reports a CVSS 3.1 base score of 9.9 and describes a remote attacker with forest-management privileges creating a persistent unauthorized administrator account. No confirmed exploitation appears in the sources consulted, and the record lists no fixed releases.

A pre-authentication code injection flaw in the ChurchCRM setup wizard, tied to unsanitized DB_PASSWORD input, remains exploitable after an incomplete fix for CVE-2026-39337. The CNA scores it critical at CVSS 3.1 10.0, and the record states it is fixed in version 7.3.2. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list it.

CVE-2026-13880 is a use-after-free flaw in the USB component of Google Chrome on Mac. A remote attacker who has already compromised the renderer process could potentially use a crafted HTML page to attempt a sandbox escape. The CNA and CISA-ADP score it 9.6 (Critical) under CVSS 3.1, while Chromium lists its internal severity as Medium, and no confirmed exploitation appears in the sources consulted.

DevGuard versions before 1.2.2 accept a client-supplied X-Admin-Token header as the authenticated user identifier when no Kratos session cookie is present. The CNA description states that an unauthenticated attacker who knows or can guess a target user's identity UUID could act as that user, including organisation admins or owners. Upgrading to 1.2.2 or later is the stated remedy.

Gradient 1.1.0 contains a missing authentication flaw (CWE-306). When GRADIENT_DISCOVERABLE is enabled, which is the default, anyone who can reach the /proto endpoint can register as a worker without credentials. The record states the issue is fixed in 1.1.1 and reports a CVSS 3.1 base score of 9.4, but it does not list the CVE in CISA KEV and no confirmed exploitation appears in the sources consulted.

Versions of fast-jwt before 6.2.4 can accept JWTs verified against an empty HMAC key when the application's async key resolver returns an empty string. The sources describe this as a critical authentication bypass with a CVSS 3.1 score of 9.1, and the description states it is fixed in 6.2.4. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-44377 affects CubeCart versions before 6.7.0. An authenticated administrator can abuse a server-side template injection in the Smarty engine to reach sensitive data and execute code on the server. The description states the issue is fixed in 6.7.0, and the record lists a CVSS 3.1 base score of 9.1.