CVE-2026-79205

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the browser's Network component allows a remote attacker to bypass the web origin policy. By enticing a user to open a specially crafted HTML page, an attacker could potentially gain unauthorized access to sensitive...

CVE-2026-79203

A flaw was found in DevTools in Google Chrome. Improper input validation allows a remote attacker, who has already compromised the browser's rendering process, to bypass site isolation. Site isolation is a security feature designed to protect sensitive information by ensuring that content from...

CVE-2026-79201

A flaw was found in Chromium. Improper access control in the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actions...

CVE-2026-79116

A flaw was found in Viz in Google Chrome. Missing authorization allowed a remote attacker, who had already compromised the renderer process, to bypass the web origin policy. This could be achieved by tricking a user into visiting a specially crafted HTML page, potentially leading to unauthorized...

CVE-2026-79094

A flaw was found in the Workers component of Google Chrome. This race condition vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, an attacker can exploit this flaw, leading to unauthorized access within the system...

CVE-2026-79093

A flaw was found in Paint in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to potentially bypass the web origin policy by crafting a malicious HTML page. This could lead to unauthorized access to sensitive information or actions across different web origins...

Malicious code in hydration-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480 The package's main entry dist/index.mjs locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached child process every time the...

CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

EUVD-2026-60382

Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url...

CVE-2026-3035

GitLab EE is affected by an improper authorization check that allows an authenticated user with project Maintainer permissions to access the terminal of a protected environment they are not authorized to use, under certain conditions. The vulnerability affects versions from 11.3 before 19.1.7, 19...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-7487

GitLab EE is affected by an improper authorization check where the access control check is implemented after the asset is accessed . An authenticated user with reporter-role permissions who authored a merge request could reset merge request approval rules under certain conditions. The vulnerabili...

CVE-2026-75896 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5...

CVE-2026-78892

A flaw was found in Chromoting in Google Chrome. A local attacker can exploit an incorrect authorization vulnerability by running a local program. This allows the attacker to bypass system access restrictions...

CVE-2026-12587

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-18664

A flaw was found in NSD. On systems using little-endian architecture, the software incorrectly compares IP addresses against defined Access Control List ACL ranges. This misinterpretation can lead to a bypass of intended access controls, where IP addresses that should be denied access are instead...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Beschreibung: Nutzt den Path-Traversal-Schwachstelle im @fs-Endpunkt des Vite Development Servers CVE-2025-31125 aus, um über manipulierte URLs auf sensible Dateien wie /etc/passwd und /etc/hosts zuzugreifen. Erstellt von Muhammad Waseem. Verwendung: python...