23219 matches found
EUVD-2026-63078
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...
[SECURITY] [DSA 6451-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6451-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 19, 2026 https://www.debian.org/security/faq -...
CVE-2026-63407
The Grav API Plugin (getgrav/grav-plugin-api) for Grav CMS had a CORS misconfiguration in its CorsMiddleware. Prior to version 1.0.0-rc.16 , the middleware returned Access-Control-Allow-Origin: * and permissive OPTIONS responses on authenticated /api/v1 endpoints. Because authentication uses the ...
PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...
CVE-2026-76041
A flaw was found in chromium-browser. An information leak in the Skia component allows a remote attacker to potentially bypass the web origin policy by crafting a malicious HTML page. This could lead to unauthorized access to sensitive information across different web origins. Mitigation Avoid...
CVE-2026-76033
A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing CORS. A remote attacker, who has already compromised the browser's renderer process, could exploit this vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass site isolation, a...
CVE-2026-74974
Same-origin policy bypass in the Graphics: ImageLib component. This vu...
UBUNTU-CVE-2026-74963
Same-origin policy bypass in the Networking: Cookies component. This v...
UBUNTU-CVE-2026-74934
Site isolation issue in the Graphics: CanvasWebGL component. This vuln...
UBUNTU-CVE-2026-74956
Same-origin policy bypass in the DOM: Service Workers component. This...
UBUNTU-CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This...
CVE-2026-74970
Site isolation issue in the Graphics component. This vulnerability was...
UBUNTU-CVE-2026-74968
Site isolation issue in the Graphics: WebRender component. This vulner...
Linux Distros Unpatched Vulnerability : CVE-2026-74974
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR...
CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This...
CVE-2026-74963
Same-origin policy bypass in the Networking: Cookies component. This v...
UBUNTU-CVE-2026-74974
Same-origin policy bypass in the Graphics: ImageLib component. This vu...
Linux Distros Unpatched Vulnerability : CVE-2026-74963
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird...
Debian dsa-6451 : firefox-esr - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6451 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6451-1 [email protected] https://www.debian.org/securit...