CVE-2026-106365

A missing authorization flaw in the Animation component of the Chromium browser (Google Chrome) allows a remote attacker to bypass web origin policy via a crafted HTML page. This vulnerability affects versions prior to 155.0.8059.39 . No specific exploit details or remediation steps are provided ...

CVE-2026-106286

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

EUVD-2026-93857

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106286

A confused deputy vulnerability in the Omnibox component of Google Chrome (prior to version 155.0.8059.39 ) allows a remote attacker to bypass the web origin policy using crafted network traffic. This flaw has a Chromium security severity of Medium . Remediation is available in version 155.0.8059...

EUVD-2026-93815

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106396

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106396

A high-severity improper input validation flaw exists in the Omnibox component of Google Chrome on Android (versions prior to 155.0.8059.39). A remote attacker can leverage social engineering to bypass the web origin policy by tricking a user into visiting a crafted HTML page. This vulnerability ...

EUVD-2026-93800

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106366

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106366

A high-severity vulnerability exists in the CustomTabs component of Google Chrome on Android prior to version 155.0.8059.39 . The root cause is an incomplete cleanup flaw, which allows a remote attacker to bypass the web origin policy by navigating the user to a crafted HTML page. This issue has ...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-104069

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

EUVD-2026-93436

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069

HortusFox versions prior to 6.2 are vulnerable to Remote Code Execution (RCE) via the ThemeModule::startImport() function. The root cause is the direct extraction of uploaded ZIP archives into the public web root without validating filenames, extensions, or content. An authenticated administrator...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Web Plura Backup & Restore Manager versions = 0.2.25...

CVE-2026-32570

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...