Vulnerability-Disclosure-Policy

Vulnerability Disclosure Policy We believe that vulnerability disclosure is a two-way street. Vendors, as well as researchers, must participate in co-ordinated vulnerability disclosure. When Enable Security discovers vulnerabilities through its own research, it will notify vendors of these...

Astra Linux – vulnerability in Chromium

A heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Astra Linux – vulnerability in Chromium

Improper storage implementation in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Astra Linux – vulnerability in Chromium

A heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page...

Astra Linux – vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption; we assume that with sufficient effort, some of them could have been exploited to execute arbitrary code. This vulnerability affects...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.212, using Autofill in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – vulnerability in Chromium

In IndexedDB in Google Chrome prior to version 90.0.4430.72, using “After Free” allowed attackers who convinced users to install a malicious extension to potentially perform a sandbox escape by crafting a Chrome Extension...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2026-103548

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

EUVD-2026-90362

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548

The Itron MV-90 xi 3.0 contains improperly stored passwords within its configuration file. This vulnerability allows an attacker to decode both current passwords and password histories, potentially granting unauthorized access to the MV-90 application as any user. No specific remediation steps or...

PT-2026-103525

Name of the Vulnerable Software and Affected Versions Itron MV-90 xi version 3.0 Description Passwords and password histories are stored improperly in the configuration file, allowing attackers to decode them and gain unauthorized access to the MV-90 application as any user. Recommendations At th...

CVE-2026-103548: Storing Passwords in a Recoverable Format

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

Malicious code in key_frog_salmon-90 (npm)

Source: amazon-inspector 733e248168c21e062596b6724ecb65227ed6e4f26c6d6fbcd87b4cf8d218bf53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Astra Linux – Vulnerability in Chromium

Using “after free” in Aura in Google Chrome before version 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Malicious code in international_donkey_tomato-90 (npm)

Source: amazon-inspector 23347f4a598724598806988ab9b5e1b0e89f8233e1f61fc3b86a5e574665ab8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intact_moth_lavender-90 (npm)

Source: amazon-inspector 72749805aa362d32e461a944e7010ebacaa7e19787180dc47fcb1fac586f069c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...