SUSE CVE-2026-17920

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2026-17927

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2026-17948

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2026-17952

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2026-17976

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. Chromium security severity: Low...

SUSE CVE-2026-17998

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2026-35454

The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback tha...

SUSE CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

CVE-2026-61536 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...

CVE-2026-61536

CVE-2026-61536 affects Banks prior to version 2.4.3. The vulnerability arises from an unsafe import path resolution in the CompletionExtension: the tool’s import_path is resolved via importlib.import_module(...) + getattr(...) without an allowlist or sanitization, enabling an attacker-controlled ...

SUSE CVE-2026-54069

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empt...

JLSEC-2026-822

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size...

CVE-2026-64193

A flaw was found in Net::DNS. A remote attacker can exploit a vulnerability in the handling of EDNS Extension Mechanisms for DNS EXTENDED ERROR options, leading to arbitrary code execution. The affected component processes the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option without properly...

pgaudit v19beta2

pgAudit Open Source PostgreSQL Audit Logging Introduction The PostgreSQL Audit Extension pgAudit provides detailed session and/or object audit logging via the standard PostgreSQL logging facility. The goal of pgAudit is to provide PostgreSQL users with capability to produce audit logs often...

Low: Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

An update for the php:8.2 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Low: Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-17778

A flaw was found in Google Chrome. This use-after-free vulnerability in the Extensions component allows a remote attacker to execute arbitrary code within a sandbox. This can be exploited by convincing a user to install a specially crafted Chrome Extension...

bramble v1.11.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

DEBIAN-CVE-2026-17998

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-17998

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...