Linux Distros Unpatched Vulnerability : CVE-2026-87463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via...

PT-2026-89134

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

PT-2026-88697

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description A UI misrepresentation in CustomTabs allows a remote attacker to spoof the address bar through a co-installed application. Recommendations Update Google Chrome on Android to...

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

Linux Distros Unpatched Vulnerability : CVE-2026-87486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app...

CVE-2026-79324: Authorization Bypass Through User-Controlled Key

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

PT-2026-88563

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description Incorrect authorization in Certificate allows a remote attacker to potentially spoof the address bar by using crafted network traffic. Recommendations Update Google Chrome on...

CVE-2026-87567: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted domain name. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-87567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof address bar via a...

CVE-2026-87597: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app. Chromium security severity: Low...

CVE-2026-87486: Improper Restriction of Rendered UI Layers or Frames

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...

CVE-2026-79324

The mageplaza/module-gdpr extension for Magento 2 (versions through 4.2.9 ) is vulnerable to an authorization bypass in the Address Delete controller . Because the controller extends the legacy Action class instead of AbstractAccount , it fails to enforce authentication , ownership , or form key ...

PT-2026-89261

Name of the Vulnerable Software and Affected Versions Bulk Password Reset versions prior to 1.3.4 Description This issue allows authenticated attackers with subscriber-level access and above to perform privilege escalation via account takeover. The flaw exists because the plugin fails to properly...

CVE-2026-87463: Incorrect Authorization

Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. Chromium security severity: Low...

PT-2026-88586

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description A clickjacking issue exists in TrustedWebActivities, which allows a local attacker to spoof the address bar using a co-installed application. Clickjacking is a technique wher...

Linux Distros Unpatched Vulnerability : CVE-2026-87597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app...

GHSA-2X7J-588G-CCC2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...