CVE-2026-94952: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ipsubnet and fwip request parameters during th...

CVE-2026-95352: Incorrect Authorization

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95352): chromium -- security fixes

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-102329: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

PT-2026-102944

Name of the Vulnerable Software and Affected Versions Mediawiki - CentralNotice extension versions prior to 1.46.1 Mediawiki - CentralNotice extension version 1.45.5 Mediawiki - CentralNotice extension version 1.43.10 Description Improper neutralization of input during web page generation leads t...

CVE-2026-102676: Improper Privilege Management

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration...

CVE-2026-86450: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19...

CVE-2026-4034: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-95297: Missing Authorization

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95285: Missing Authorization

Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95275: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95375: Incorrect Authorization

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95374: Incorrect Authorization

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95366: Operation on a Resource after Expiration or Release

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95340: Incorrect Authorization

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102330: Incorrect Authorization

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102310: Missing Authorization

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-71189: Improper Neutralization of Input During Web Page Generation

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

PT-2026-102939

Name of the Vulnerable Software and Affected Versions Mediawiki - Refreshed skin versions prior to 1.46.1 Mediawiki - Refreshed skin versions prior to 1.45.5 Mediawiki - Refreshed skin versions prior to 1.43.10 Description Improper neutralization of input during web page generation allows for...

Epson iProjection Android Application version 3.2.6 Hard-coded Credentials

Epson iProjection Android application version 3.2.6 contains hard-coded credentials that can authenticate to the Web Control interface of affected Epson projectors...