ROS-20260721-73-0014

The vulnerability of the Media component in Google Chrome and Microsoft Edge relates to memory-related issues. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially crafted HTML page...

ROS-20260721-73-0023

The vulnerability of the Site Isolation function in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms through a specially created HTML page...

ROS-20260721-73-0035

The vulnerability of the WebAudio component in Google Chrome and Microsoft Edge relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260721-73-0045

The vulnerability of the user interfaces of Google Chrome and Microsoft Edge relates to the possibility of using memory after it is freed. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

ROS-20260721-73-0006

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20260721-73-0005

The vulnerability of the “Network” control element in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to replace the user’s interface with a specially created HTML page...

ROS-20260721-73-0030

The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge relates to the use of memory after it is released. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms through a specially created HTML page...

ROS-20260721-73-0001

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker to read and write arbitrary files remotely...

GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Missing Authorization

Overview @astrojs/vercel is a Deploy your site to Vercel Affected versions of this package are vulnerable to Missing Authorization via the isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted xastropath query parameter, causing the server to...

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

GHSA-JQH4-M9W3-8HP9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

CVE-2026-46415 Caddy Defender trusted proxy client IP bypass

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

EUVD-2026-45975

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

CVE-2026-58055

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

CVE-2026-63752

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...

CVE-2026-63752

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...

CVE-2026-63752

SurrealDB prior to 3.1.0 contains an authorization bypass in the RELATE statement. Authenticated users with CREATE permission can cause the storage layer to silently overwrite an existing edge record by issuing a RELATE with a SET id clause targeting that edge, bypassing UPDATE checks. The issue ...

CVE-2026-63752 SurrealDB before 3.1.0 RELATE Statement Record Overwrite

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...