Rocky Linux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1779124827)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779124827 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

AlmaLinux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1779124827)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779124827 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

CVE-2026-102878

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878

The mcp-chrome-bridge software, in versions through 1.0.31 , contains an origin validation error within its native-server HTTP API. This vulnerability allows an attacker to bypass CORS restrictions by crafting malicious web pages. Successful exploitation enables the execution of browser automatio...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

EUVD-2026-89413

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-97615

A flaw was found in the Linux kernel's network bridge subsystem, which can lead to a Denial of Service DoS due to list corruption. When Connectivity Fault Management CFM or Media Redundancy Protocol MRP handlers are enabled across multiple network bridges, a shared data structure is improperly...

CVE-2026-97436

A flaw was found in the Linux kernel's dpaa2-switch driver. When multiple network bridges are configured across ports on the same switch device, removing a port from a bridge fails to release its Forwarding Database FDB, which tracks network destination addresses. A privileged user modifying...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia 원격 코드 실행 RCE CVE-2026-34197은 Apache ActiveMQ Classic에 영향을 미치는 높은 심각도의 원격 코드 실행 RCE 취약점입니다. 이 문제는 /api/jolokia/ 엔드포인트를 통해 HTTP로 관리 작업을 노출하는 Jolokia JMX-HTTP 브리지에 존재합니다. 기본 Jolokia 액세스 정책은 인증된 사용자가 ActiveMQ MBeans에서 관리 작업을 호출할 수 있도록 허용합니다. 특정 브로커 관리 메서드는 사용자...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

ROS-20260929-73-0044

The vulnerability of the ebtsnattg function in the net/bridge/netfilter/ebtsnat.c module, which implements networking functions in the Linux kernel, is related to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2026-102894

Name of the Vulnerable Software and Affected Versions mcp-chrome-bridge versions prior to 1.0.32 Description An origin validation error exists in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing CORS restrictions. CORS is a security mechanism that restricts...

SUSE CVE-2026-97615

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-98026

A flaw was found in the Linux kernel's network bridge subsystem. An attacker could exploit this vulnerability to cause a Denial of Service DoS or system crash through a use-after-free condition. This issue occurs during multicast port group removal, where the kernel immediately frees data...

Malicious code in fabric-render-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01 package.json declares postinstall="node index.js", so npm install fabric-render-bridge automatically executes index.js. index.js reads Minecraft...

MAL-2026-17225 Malicious code in fabric-render-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01 package.json declares postinstall="node index.js", so npm install fabric-render-bridge automatically executes index.js. index.js reads Minecraft...

Malicious Package

Overview fabric-render-bridge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...