CVE-2026-107280: Sensitive Cookie with Improper SameSite Attribute

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2025-70517

The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross-origin resource protection for state-changing requests. This lack of protection allows for a complete bypass of the cross-origin boundary, enabling Cross-Site Request Forgery (CSRF) attacks against any applicatio...

UBUNTU-CVE-2026-93515

Present Extension Cross-Window Notify Use-After-Free...

CVE-2026-93515

Present Extension Cross-Window Notify Use-After-Free...

PT-2026-107541

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

Linux Distros Unpatched Vulnerability : CVE-2026-105111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using...

CVE-2026-14911: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-106392

An information leak flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514426571...

CVE-2026-106354

An improper resource exposure flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511796554...

CVE-2026-106297

An incorrect authorization flaw was found in the Scheduling component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513735469...

CVE-2026-103009

A flaw was found in Elasticsearch. When processing cross-cluster search requests under the Remote Cluster Security RCS model, the service validates permissions using one target identifier while retrieving data using a separate identifier. An authenticated attacker possessing a valid cross-cluster...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 security and extras update

Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-103009

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-102406

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

UBUNTU-CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

[SECURITY] [DSA 6546-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6546-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 06, 2026 https://www.debian.org/security/faq -...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-104048

A vulnerability exists in SSSD within trust-enabled identity management environments. The system incorrectly evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. This allows an authenticated user from a trusted domain to bypass access...