CVE-2026-65802

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

CVE-2026-65802 Microsoft Edge for Android Information Disclosure Vulnerability

...

CVE-2026-66314

Time-of-check time-of-use toctou race condition in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-66314 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-66314

Microsoft Edge (Chromium-based) is affected by a time-of-check time-of-use (TOCTOU) race condition that could allow an unauthenticated attacker to disclose information over a network. The vulnerability impacts the browser’s ability to protect data during network interactions. Root cause described...

CVE-2026-66314 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-66310

Microsoft Edge for Android is affected by CVE-2026-66310, described as external control of a file name or path that allows an unauthorized local attacker to disclose information. The vulnerability is labeled with CVSS v3.1 base score 7.7 (HIGH), with attack vector LOCAL, all else equal; no user i...

CVE-2026-66310 Microsoft Edge for Android Information Disclosure Vulnerability

...

CVE-2026-66310 Microsoft Edge for Android Information Disclosure Vulnerability

...

CVE-2026-66318 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-66318 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-66318

CVE-2026-66318 affects Microsoft Edge (Chromium-based). Description: origin validation error may allow an unauthorized attacker to disclose information over a network. Metrics indicate CVSS v3.1 Base Score 8.1 (High) with network attack vector, low attack complexity, no privileges required, but u...

CVE-2026-66318

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-18682

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-67972

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

OPENSUSE-SU-2026:21520-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. - CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files bsc1271151. - CVE-2026-59947: URL-embedded...

EUVD-2026-52416

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Impact Undici's cache interceptor mishandles optional whitespace OWS placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" OWS before = or no-cache= "authorization" OWS after =. The parser either drops the directive entirely or stores a...

NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

NPM: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.0...