CVE-2026-110141

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-110141

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-110141

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-110141

Google Chrome versions prior to 155.0.8059.79 are vulnerable to an observable discrepancy flaw within the Media component. A remote attacker can exploit this vulnerability by using a crafted HTML page to leak cross-origin data . This issue has been addressed in the stable channel update for Windo...

GHSA-QJPX-JQM5-H2C4 Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor...

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

CVE-2026-103030

The Dio HTTP client for Dart and Flutter contains a vulnerability in the dio_http2_adapter component (versions 1.0.0 through 2.8.0). The root cause is that Http2Adapter._fetch follows redirects by copying the original RequestOptions.headers into the redirected HTTP/2 request without performing cr...

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-55183

Prior to version 0.2.7 , RClone Manager (a cross-platform GUI for managing Rclone remotes) is vulnerable to an unauthenticated remote attack. The application launches the local rclone rcd service on 127.0.0.1:51900 using --rc-no-auth, --rc-allow-origin *, and --rc-serve. This configuration allows...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

CVE-2026-103417

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417

Firefox for iOS is vulnerable to a credential autofill issue where saved credentials could be autofilled into a new page following a cross-origin navigation. The root cause is that the autofill mechanism was not bound to the originating page and failed to reject the request when the origin change...

CVE-2025-4664

🔒 Vulnerability CVE-2025-4664 The CVE-2025-4664 vulnerability is a high-severity security flaw identified in the Loader component of Google Chrome, present in versions prior to 136.0.7103.113. This issue allows a remote attacker to leak cross-origin data via a specially crafted HTML page,...

PT-2026-113473

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An observable discrepancy in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using...

PT-2026-111679

Name of the Vulnerable Software and Affected Versions Dio versions 1.0.0 through 2.7.9 Description The dio http2 adapter follows redirects in the Http2Adapter. fetch function by copying the original RequestOptions.headers into the redirected HTTP/2 request without verifying if the source and...

CVE-2023-45857-Demo

Demo to verify the behavior of axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev on the app container 3. Access http://app.localhost 4. Verify that XSRF-TOKEN is set in the Cookie using the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false...