PT-2026-81779

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in the Bluetooth component. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by using a crafted Chrome...

PT-2026-81826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in DevTools allows a remote attacker to execute arbitrary code inside the sandbox. This is achieved by leveraging social engineering and a crafted Chrome extensio...

PT-2026-81716

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in Extensions allows a remote attacker to bypass system access restrictions through the use of a crafted Chrome extension, typically leveraging social engineerin...

PT-2026-81726

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An off-by-one error in DevTools allows a remote attacker to potentially read memory inside the sandbox. This issue can be exploited through social engineering using a crafted Chrome...

PT-2026-81655

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in the Network component. This occurs when memory is accessed after it has been freed, which can lead to instability or unauthorized execution. A remote...

PT-2026-81559

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incomplete cleanup in Chromium allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can...

PT-2026-81240

Name of the Vulnerable Software and Affected Versions Telephone Directory affected versions not specified Description Broken access control exists in the extension where the HMAC Hash-based Message Authentication Code, a mechanism for verifying data integrity and authenticity of a frontend employ...

PT-2026-81293

Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions 1.0.0 through 5.0.41 Description An authenticated and privileged stored Cross-Site Scripting XSS issue exists due to a lack of escaping in the location custom field. This allows an attacker with sufficient privileges to...

PT-2026-81229

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

PT-2026-81615

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in Extensions allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. A race condition occurs when the timing or order of...

PT-2026-81296

Name of the Vulnerable Software and Affected Versions miniOrange SAML SSO versions prior to 11.0.2 SAML SP Single Sign On – Login with ADFS versions prior to 6.4 SAML SP Single Sign On – SAML SSO login with Google Apps versions prior to 6.4 Description An authentication bypass exists due to the m...

PT-2026-81234

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

Linux Distros Unpatched Vulnerability : CVE-2026-14457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured...

PT-2026-81222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The frontend detail-view document lookup fails to apply the siteHash filter for the current site and the frontend user access filter. This differs from the regul...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the process that maps CloudEvent extension fields onto message headers without applying any header filter strategy in structured content...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

EUVD-2026-64844

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995

CVE-2026-77995 is an arbitrary account takeover vulnerability in the miniOrange OAuth Client Joomla extension, affecting versions prior to 3.2.0 . The flaw is caused by the manipulation of a cookie value , allowing an unauthenticated attacker to log in as any account on the site, including admini...