CVE-2026-79141

A flaw was found in Google Chrome Browser. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions within the browser...

CVE-2026-79138

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in ANGLE, a component used for graphics rendering, could allow a remote attacker to execute malicious code. This vulnerability can be exploited by tricking a user into visiting a specially crafted web page. Successful...

CVE-2026-79097

A flaw was found in Chromium. A remote attacker could exploit a use-after-free vulnerability in the V8 JavaScript engine by crafting a malicious HTML page. This could allow the attacker to execute arbitrary code within the sandbox environment, potentially leading to a compromise of the affected...

CVE-2026-79111

A flaw was found in Dawn in Google Chrome. A remote attacker could exploit improper input validation by crafting a malicious HTML page. This could potentially lead to arbitrary code execution outside of the browser's security sandbox...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

Malicious code in hydration-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480 The package's main entry dist/index.mjs locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached child process every time the...

LeitWacht

GitLab Runner Leitwacht Applicazione dell'egress di rete per i container CI/CD di GitLab Runner. Leitwacht previene gli attacchi alla supply chain impedendo l'esfiltrazione di segreti, controllando a cosa ogni container job può accedere sulla rete. Come Funziona Leitwacht è un agente standalone c...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

pam security update

An update is available for pam. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Pluggable Authentication Modules PAM provide a system to set up authentication...

CVE-2026-59683 OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...

EUVD-2026-66381

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

Summary IBM Integrated Analytics System includes JWT service as an internal component responsible for JSON Web Token authentication. A security issue was detected in the apjwtservice.py module where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. The absence of...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

Summary IBM Integrated Analytics System includes Magneto as an internal resource manager component. CVE-2025-36271 affects the resmgr.py module in Magneto, where a predictable salt value is used in cryptographic operations. The use of a predictable salt weakens the effectiveness of hashing and...

FTPBuster

FTPBuster FTPBuster è un potente strumento da riga di comando progettato per attacchi di forza bruta a server FTP, SFTP e FTPS esplicito tramite attacchi basati su dizionario. È pensato per hacking etico e penetration testing Caratteristiche Supporto per forza bruta su FTP , SFTP e FTPS esplicito...

EUVD-2026-66294

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

Replay Attack

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Replay Attack in the DIGEST authenticator’s nonce-count window handling. An attacker can reuse a valid DIGEST-authenticated request...

PT-2026-82360

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw sentry api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit ha...