CVE-2026-73611: Insufficient Session Expiration

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71372

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

CVE-2026-73612: Authorization Bypass Through User-Controlled Key

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

PT-2026-71440

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-45819: Incorrect Control Flow Scoping

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CVE-2026-19657

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

CVE-2026-19657 ScadaLTS Unauthenticated Reflected XSS

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

EUVD-2026-57417

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

CVE-2026-19657 ScadaLTS Unauthenticated Reflected XSS

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

EUVD-2026-57327

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...

CVE-2026-19560

A flaw was found in chromium-browser. A remote attacker could exploit a use-after-free vulnerability in the Blink component by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution within the sandbox environment, potentially compromising the affected...

CVE-2026-19151

A flaw was found in chromium-browser. A remote attacker could exploit a use-after-free vulnerability in the V8 JavaScript engine by crafting a malicious HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox, potentially leading to further system compromis...

MAL-2026-13810 Malicious code in gdwkh6vcbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 149331c58c86a1da87dcdde4ec9e7f780a879ca2283946418cfff31077797bd4 Package [email protected] ships a single index.html declared as main, with no JavaScript entry point, no install lifecycle hooks, and placeholder-only...

RHSA-2026:54185 Red Hat Security Advisory: firefox security update

Bulletin has no description...

RHSA-2026:54182 Red Hat Security Advisory: firefox security update

Bulletin has no description...

RHSA-2026:54180 Red Hat Security Advisory: firefox security update

Bulletin has no description...

CVE-2026-19558

A flaw was found in Google Chrome Extensions. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user is convinced to install a specially crafted malicious extension...

CVE-2026-19556

A flaw was found in chromium-browser. This use-after-free vulnerability in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user visits a specially crafted HTML page, leading to a compromise of the affected system...