CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

CVE-2026-90904 Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

SUSE CVE-2026-95352

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

openssl: openssl: Denial of Service via race condition in certificate extension caching

A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service DoS by initiating concurrent connections to a multi-threaded Transport Layer Security TLS client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously...

php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

[SECURITY] Fedora 45 Update: postgresql16-anonymizer-3.2.2-1.fc45

PostgreSQL Anonymizer is an extension to mask or replace personally identifiable information PII or commercially sensitive data from a PostgreSQL database. The project has a declarative approach of anonymization. This means you can declare the masking rules using the PostgreSQL Data Definition...

PT-2026-97614

Name of the Vulnerable Software and Affected Versions ByteDance Coze Scraper Extension versions prior to 2.0.3 Description An issue exists in the External Message Handler component within the static/background/index.js file. The chrome.runtime.onMessageExternal.addListener function fails to...

PT-2026-97536

Name of the Vulnerable Software and Affected Versions Mediawiki - WikiLambda Extension versions prior to 1.47.0 Description Improper handling of insufficient permissions or privileges allows accessing functionality not properly constrained by Access Control Lists ACLs, which are sets of rules tha...

CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-96680: Missing Authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification

Phishing emails that impersonate Nigerian fintech providers can combine deceptive sender addresses, lookalike links, and locally familiar language. This study presents a Gmail browser extension that integrates sender-domain and URL checks with a bidirectional long short-term memory BiLSTM...

CVE-2026-93352: Unrestricted Upload of File with Dangerous Type

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

CVE-2026-96872: Improper Handling of Insufficient Permissions or Privileges

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

Exploit for CVE-2026-84388

FortiPAM Chrome Extension UI Layer RCE PoC - CVE-2026-84388...

CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

CVE-2026-80154

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-80154

CVE-2026-80154 affects all firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 . The vulnerability resides in the web management portal , where session tokens are generated deterministically from the device model and current time at one-second resolution , yield...

EUVD-2026-84518

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

CVE-2026-92706

Dark Reader , a browser extension that darkens web page colors, is vulnerable in its image inversion pipeline prior to version 4.9.126. A website can cause the extension to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTT...