PT-2026-81810

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A UI misrepresentation in the navigation component allows a remote attacker to spoof the address bar by using a crafted HTML page. Recommendations Update to version 152.0.7977.65 or lat...

PT-2026-81579

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in Core allows a remote attacker who has compromised the renderer process to potentially spoof the address bar using a crafted HTML page. Recommendations Update...

nodejs24 security update

1:24.18.0-5.0.1 - Add c-ares as dependency orabug 39781256 - Update upstream references 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - Fix CVE-2026-13149 brace-expansion...

CVE-2026-79233: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-72699: Observable Discrepancy

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

EUVD-2026-64891

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cifs: preventing use-after-free by freeing the cfile later. In smb2compoundop, there is a potential use-after-free that may lead to difficult debugging issues in the future. This issue was identified during stress testing with th...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: The issue of NULL bus dereference in ofpcirangeparserone has been fixed. The rework of the bus matching process resulted in ofmatchbus returning NULL for nodes that have ranges/dma-ranges but no local address-cells. parserinit...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: Stop the leased RX queue before uninstalling its memory provider. The netifrxqcleanupunlease function destroys the memory provider that was installed on a physical RX queue through a netkit queue lease. Currently, the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to the user space even when PERFSAMPLEBRANCHUSER is requested. O...

CVE-2026-75975

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

CVE-2026-75975

fast-uri is a URI parser for Node.js whose custom bracketed IPv6 literal parser fails to validate the full IPv6 grammar. Invalid trailing text in an authority is silently discarded, causing a malformed attacker-controlled host to normalize to a different valid IPv6 destination (e.g., the unspecif...

CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...