52756 matches found
CVE-2026-74880
opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101121)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101121 advisory. Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbi...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101104)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101104 advisory. An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers...
CVE-2026-75529: Improper Neutralization of Input During Web Page Generation
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/ /.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101125)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101125 advisory. Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101313)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101313 advisory. Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Tenable has extract...
Cross-site Request Forgery (CSRF)
Overview @fastify/oauth2 is a Perform login using oauth2 protocol Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the OAuth state-check cookies in the index.js authorization flow. An attacker can log a victim into the attacker’s account by planting...
libretto v0.6.45
Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...
Cross-Site Scripting (XSS)
Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...
[SECURITY] Fedora 43 Update: chromium-151.0.7922.137-1.fc43
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 44 Update: chromium-151.0.7922.137-1.fc44
Chromium is an open-source web browser, powered by WebKit Blink...
Chromium: CVE-2026-19557 Use after free in TabStrip
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Malicious code in @lodash-js/lodash-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency...
CVE-2026-72970 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
...
CVE-2026-72970 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
...
CVE-2026-45819
A flaw was found in baseline-browser-mapping. This vulnerability allows an attacker to cause a denial of service by providing invalid or conflicting input parameters. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate...
CVE-2026-72837
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72837
Summary: CVE-2026-72837 affects File Browser prior to 2.63.20, where createUserDir isolation in proxy and hook authentication auto-provisioning paths is not honored. This allows attackers with valid upstream-auth credentials to read, modify, delete, and share files belonging to other users due to...