CVE-2026-96454 Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

CVE-2026-96454

The Pake tool, which converts websites into desktop applications using Tauri , contains a vulnerability where generated applications grant unrestricted IPC access to any HTTPS origin. The issue stems from two inherited settings: a wildcard in src-tauri/capabilities/default.json (allowing IPC from...

EUVD-2026-85184

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

CVE-2026-96443

A vulnerability exists in Apache Doris due to insufficient validation of the JDBC driver URL . This flaw allows a privileged user to achieve remote code execution (RCE) on the FE (Front-End) . While the CVSS score indicates a medium severity, the technical impact is described as partial. No speci...

EUVD-2026-85178

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-95626

The Tauri framework v2 contains a vulnerability where its Content Security Policy (CSP) hardening is ineffective against specific URI schemes. While Tauri injects a random nonce to restrict script execution, the CSP Level 3 specification allows data: and blob: schemes to remain active even when a...

EUVD-2026-85177

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-15027

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-57223

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. On Windows, the service installation logic can pass an unquoted service ImagePath. This allows a local low-privileged attacker to execute arbitrary code...

CVE-2026-67549

A flaw was found in OpenImageIO. A remote attacker could exploit this vulnerability by tricking a user into processing a specially crafted 1-bit CMYK TIFF image. The tiffinput::bitconvert function incorrectly writes 8-bit output into a smaller buffer allocated for 1-bit data, causing a heap...

CVE-2026-63638

A flaw was found in OpenImageIO. A remote attacker could exploit this vulnerability by providing a specially crafted Cineon image file. This crafted file, when processed, can lead to a heap out-of-bounds write due to an invalid bit depth declaration, resulting in memory corruption. This could...

CVE-2026-87902

CVE-2026-87902...

CVE-2026-63422

A flaw was found in OpenImageIO. When processing specially crafted tiled OpenEXR images, where the image width is not a multiple of its tile width, a heap out-of-bounds write can occur. This vulnerability arises from incorrect calculation of scanline stride during tile reading, leading to memory...

CVE-2026-54355

A flaw was found in MapServer, a system for developing web-based GIS applications. This reflected Cross-Site Scripting XSS vulnerability occurs in the OpenLayers HTML output when the HTTPXFORWARDEDHOST value is not properly escaped. An unauthenticated attacker can craft a malicious URL that, when...

DROS-VEP-lite

🛡️ VEP: Banco de Pruebas Abierto para la Investigación en Seguridad de Agentes Una Infraestructura de Evaluación Componible a Nivel de Sistema para la Investigación en Post-Compromiso e IA Física "VEP Vulnerability & Exploitability Protocol es un entorno de evaluación de investigación abierto e...

R2S_CVE-2025-55182

CVE-2025-55182 扫描器 用于 CVE-2025-55182 的漏洞扫描器 - Next.js 服务器操作中的远程代码执行。 关于 CVE-2025-55182 严重性: 严重 CVSS 待定 受影响版本: Next.js: 15.x 15.5.7, 16.0.x 16.0.7 React: 19.0.0, 19.1.0, 19.1.1, 19.2.0 影响: 远程攻击者可以在运行易受攻击的 Next.js 应用（启用了服务器操作）的服务器上执行任意代码。该漏洞源于 React 服务器组件协议中对原型污染的不当处理。 修复版本: Next.js: ≥15.5.7 或...

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome CVE-2026-85046,...

Vulnerabilities found in Check Point VPN products

Check Point has addressed 2 critical vulnerabilities. The vulnerability with the identifier CVE-2026-85102 has a CVSS score of 9.8. This vulnerability resides in the VPN negotiation process of the Quantum Security Gateway and is caused by incorrect validation of certificate trust. As a result, an...

CVE-2025-1974

CVE-2025-1974 — IngressNightmare ingress-nginx Introducción Este documento presenta la investigación de la vulnerabilidad CVE-2025-1974 , que afecta al componente ingress-nginx validating admission controller para Kubernetes. CVE-2025-1974 es una vulnerabilidad crítica CVSS 3.1 9.8, que consiste ...