PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-106297: Incorrect Authorization

Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106286: Unintended Proxy or Intermediary

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

PT-2026-107191

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager affected versions not specified Description Authentication bypass flaws exist in the web-based management and API interfaces. These issues allow an unauthenticated remote attacker to circumvent...

Cisco ASA Cross-site Scripting (CVE-2020-3580)

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web services interface of an...

CVE-2026-106289: Missing Authorization

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107189

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager versions prior to 6.14.1 Description Deserialization of untrusted data in the web interface allows an unauthenticated remote attacker to execute arbitrary code on the affected system. Deserialization is...

CVE-2026-76752: Improper Authentication

Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affect...

CVE-2026-106418: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

CVE-2026-106189: Improper Control of Generation of Code

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106287: Information Loss or Omission

Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

CVE-2026-79799: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary...

CVE-2026-79798: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

CVE-2026-106221: Unintended Proxy or Intermediary

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

Cisco ASA Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-3259)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential...

Cisco ASA/FTD Cross-site Scripting (CVE-2020-3581)

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web services interface of an...

Cisco ASA Basic XSS (CVE-2024-20382)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

CVE-2026-96404: Improper Authentication

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791305177)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791305177 advisory. - Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-76750: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system...