The vulnerability of the Web Speech component in Google Chrome and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Web Speech component in Google Chrome and Microsoft Edge relates to reading beyond the buffer limit. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through a specially...

The vulnerability of the WindowDialog component in Google Chrome and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WindowDialog component in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the rendering process and affect the confidentiality, integrity, and accessibility of protect...

CVE-2026-5323

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

CVE-2026-5323

The CVE-2026-5323 entry affects priyankark a11y-mcp (up to 1.0.5), specifically the A11yServer function in src/index.js, causing a server-side request forgery. Exploitation requires a local position. An exploit has been made public. Upgrade to version 1.0.6 to resolve, with patch id e3e11c9e8482b...

CVE-2026-5323

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

PT-2026-29684

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

A11y MCP Server 代码问题漏洞

A11y MCP Server is a web accessibility testing tool developed by Priyankar Kumar as an individual project. Versions of A11y MCP Server 1.0.5 and earlier contained code vulnerabilities. These vulnerabilities stemmed from a server-side request forgeing vulnerability in the A11yServer function locat...

PT-2026-33149

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.101 Description An uninitialized use in the Accessibility component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to potentially perform a sandb...

The vulnerability of the hfscorrect_next_unused_CNID() function in the fs/hfs/catalog.c module of the Linux kernel file system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hfscorrectnextunusedCNID function in the fs/hfs/catalog.c module of the Linux operating system’s kernel relates to the use of memory after deallocation. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox 140.9.0 ESR MFSA 2026-22, bsc1260083: CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-4686:...

The vulnerability of the gdi_SurfaceCommand_ClearCodec() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the gdiSurfaceCommandClearCodec function in the RDP client FreeRDP is caused by a buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the planar_decompress_plane_rle() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the planardecompressplanerle function in the FreeRDP RDP client is related to data writing beyond the specified buffer. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ext4_alloc_inode() function in the fs/ext4/super.c module of the Ext4 file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4allocinode function in the fs/ext4/super.c module of the Ext4 file system in the Linux operating system is related to the use of uninitialized resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2025-10736

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility function in all versions up to, and including, 2.2.10. This...

CVE-2026-25186

Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure ATBroker.exe allows an authorized attacker to disclose information locally...

CVE-2026-24291

Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure ATBroker.exe allows an authorized attacker to elevate privileges locally...

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Skia graphic library in Google Chrome and Microsoft Edge relates to reading beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through a special...

CVE-2025-10736

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility function in all versions up to, and including, 2.2.10. This...

AI in Cybersecurity Education -- Scalable Agentic CTF Design Principles and Educational Outcomes

Large language models are rapidly changing how learners acquire and demonstrate cybersecurity skills. However, when human--AI collaboration is allowed, educators still lack validated competition designs and evaluation practices that remain fair and evidence-based. This paper presents a...

New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

Cybersecurity researchers have disclosed a new Android malware family called Perseus that's being actively distributed in the wild with an aim to conduct device takeover DTO and financial fraud. Perseus is built upon the foundations of Cerberus and Phoenix, at the same time evolving into a "more...