CVE-2026-11008

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-11283

Google Chrome on Mac versions prior to 149.0.7827.53 is vulnerable to a policy bypass in Shortcuts due to insufficient validation of untrusted input. A remote attacker can exploit this flaw via a malicious file to bypass navigation restrictions. The vulnerability is associated with CWE-20 (Improp...

CVE-2026-11133

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11023

The WebAppInstalls component in Google Chrome and Microsoft Edge is vulnerable to a security flaw caused by insufficient validation of input data (improper implementation). A remote attacker who has already compromised the renderer process can exploit this by using a specially crafted HTML page t...

CVE-2026-11023

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-10923

A use after free vulnerability exists in the WebAppInstalls component of Google Chrome on Android (prior to version 149.0.7827.53 ) and Microsoft Edge . The root cause involves the reuse of the component after it has been freed, which may allow a local attacker to execute arbitrary code via a mal...

CVE-2026-41249

creationtimestamp| type| source ---|---|--- 2026-06-04 21:01:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnijg3sqtc22 2026-06-04 22:21:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mninur6c7d2w 2026-06-04 22:47:45+00:00| seen|...

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Summary app.mount strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte...

CVE-2026-5228

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka are vulnerable to loss of confidentiality (CVE-2025-27817, CVE-2025-27818)

Summary Apache Kafka Client is used by IBM App Connect Enterprise Certified Container when running flows that connect to a Kafka server. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka Client are vulnerable to loss of confidentiality...

CVE-2026-5228

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026...

CVE-2026-5228 Improper Access Control in Kurt Software Studio's WriteUp Mobile App

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026...

EUVD-2026-34283

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026...

CVE-2026-5228

Technical details beyond the Initial Description are not publicly available in the provided documents. Monitor for updates.

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-48710 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

EUVD-2026-34187

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function saveaudiotocache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high...