Daily Brief - 2026-10-21

2026-10-21 · 4 vulnerabilities · 6 min listen

CVE-2026-113339

high · CVSS 8.8 · Google Chrome

Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use After Free
Remote Code Execution
web browser

CVE-2026-86961

high · CVSS 7.8 · Apple Operating System

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

Sandbox Escape
Race Condition
mobile operating system
desktop operating system

CVE-2026-91663

critical · CVSS 9.9 · Oracle Essbase

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Remote Code Execution
business intelligence
middleware

CVE-2026-93442

high · CVSS 8.2 · IBM QRadar SIEM

IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

Out-Of-Bounds Read
Denial Of Service
siem