CVE-2026-79117

Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. Chromium security severity: High...

GO-2026-6266 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code...

GO-2026-6263 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code...

CVE-2026-43657

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

EUVD-2026-65740

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

CVE-2026-43657

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

CVE-2026-43657

A permissions issue in iOS and iPadOS allows a malicious app to enumerate installed apps . The root cause is a lack of sufficient restrictions, which has been addressed by implementing additional permissions restrictions. The vulnerability is fixed in versions iOS 26.5 and iPadOS 26.5 . No specif...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...

OS Command Injection

React create-react-app is vulnerable to OS command injection. The vulnerability is due to improper handling of input in the startBrowserProcess function of openBrowser.js in react-dev-utils, which allows an attacker to manipulate the input and execute arbitrary operating system commands remotely...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

PT-2026-81730

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Incorrect authorization in CustomTabs allows a local attacker to bypass the web origin policy through a co-installed application. The web origin policy is a security mechanis...

PT-2026-81561

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An observable discrepancy in CustomTabs allows a local attacker to obtain cross-origin data through a co-installed application. Cross-origin data refers to information...

PT-2026-81782

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Incorrect authorization in CustomTabs allows a local attacker to bypass the web origin policy through a co-installed application. The web origin policy is a security mechanis...

PT-2026-81651

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description A race condition exists in the Start function that could allow a local attacker, using social engineering, to potentially execute arbitrary code outside the sandbox via a...

PT-2026-81548

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An observable discrepancy in CustomTabs allows a local attacker to obtain cross-origin data through a co-installed application. Cross-origin data refers to information...

PT-2026-81490

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.5 iPadOS versions prior to 26.5 Description A permissions issue exists where a malicious application may be able to enumerate installed apps on the device. Recommendations Update iOS to version 26.5. Update iPadOS to...

PT-2026-81649

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An information leak exists in the Sharing component that allows a local attacker to obtain sensitive information via a co-installed app by leveraging social engineering...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...