Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify...

CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure...

New Browser Guard features add protection before and after you click

Most of us click on search results without knowing much about the website we’re about to visit. And once we’re there, it’s not always obvious when something isn’t quite right. Now, we’ve added two new features to Malwarebytes Browser Guard that will do even more to keep you safe online. Search...

PT-2026-98316

Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...

MiracleLinux 9 : webkit2gtk3-2.54.0-1.el9_8 (AXSA:2026-1904:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1904:08 advisory. chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via...

SUSE CVE-2026-95298

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

DRUPAL-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the mediaIsInUse function. An attacker can execute arbitrary JavaScript in the context of an administrator's browser session by injecting malicious payloads into the type name field, which are rendered...

CLEANSTART-2026-YT00725 baseline-browser-mapping 2

Security vulnerability affects the qdrant package. baseline-browser-mapping 2...

Linux Distros Unpatched Vulnerability : CVE-2026-95298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI...

Linux Distros Unpatched Vulnerability : CVE-2026-91713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements...

PT-2026-97451

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.6 Description A Cross Site Scripting XSS issue exists that allows users with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update wpForo Forum to version...

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97666

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97461

Name of the Vulnerable Software and Affected Versions Razorpay Payment Button versions prior to 2.5.0 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update Razorpay Payment Butto...

Linux Distros Unpatched Vulnerability : CVE-2026-95294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a craft...

PT-2026-97453

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.3.02.003 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-97444

Name of the Vulnerable Software and Affected Versions Event Tickets versions prior to 5.29.5 Description An unauthenticated Cross Site Scripting XSS issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

CVE-2026-4921: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...