Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-16970 DFIR-IRIS Insufficient Logout Implementation

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

VulnCheck KEV: CVE-2026-56155

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally...

CVE-2026-25602

Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA MEONA Client and MEONA Server. The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address...

The vulnerability of the user interface of the Cisco Catalyst SD-WAN Manager centralized system management platform allows a perpetrator to disclose protected information.

The vulnerability of the user interface of the Cisco Catalyst SD-WAN Manager centralized system management system is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

CVE-2026-40448

Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0...

PT-2026-34255

CVE-2026-40448 Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE. Affected v… https://t.co/x8HxY9Raln...

CVE-2026-34236

CVE-2026-34236 affects the Auth0-PHP SDK. In versions 8.0.0 through 8.18.0, cookies are encrypted with insufficient entropy, which may allow threat actors to brute-force the encryption key and forge session cookies. Multiple trusted sources (NVD, Red Hat, CIRCL, OSV, PT Security, CNNVD) consisten...

CVE-2026-3939

Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file. Chromium security severity: Low...

CVE-2026-1643

The CVE-2026-1643 entry concerns the MP-Ukagaka WordPress plugin with Reflected Cross-Site Scripting vulnerabilities in all versions up to 1.5.2, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that are ex...

ROS-20260203-73-0008

A vulnerability in the vxlanvnifilter.c component of the Linux operating system kernel is related to insufficient blocking. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Arbitrary Code Execution

Orval is vulnerable to Arbitrary Code Execution. The vulnerability is due to incomplete sanitization of untrusted input during code generation, where insufficient escaping in jsStringEscape allows attackers to inject executable JavaScript using only non-alphanumeric characters via JSFuck...

CVE-2026-0905

Google Chrome versions prior to 144.0.7559.59 are affected by a security bypass vulnerability due to insufficient policy enforcement within the Network component. An attacker who successfully obtains a network log file can exploit this weakness to potentially access sensitive information . This v...

CVE-2020-10211

A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive...

CVE-2020-12498

mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation...

PT-2025-52537

Name of the Vulnerable Software and Affected Versions WP Hallo Welt plugin versions prior to 1.5 Description The WP Hallo Welt plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the hallo welt seite function. This allows...

Apple macOS Tahoe Logic Insufficient Limits Vulnerability

Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from a Logical Restriction Insufficiency vulnerability that can be exploited by an attacker to...

Apple macOS Tahoe Insufficient Privilege Restriction Vulnerability

Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from a permission restriction insufficiency vulnerability that stems from a flaw in the system'...

Reflected Cross-Site Scripting (XSS)

NiceGUI is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper sanitization or encoding in the ui.addcss, ui.addscss, and ui.addsass functions, which allows an attacker to inject closing tags and execute arbitrary JavaScript...

Apple macOS Tahoe 安全漏洞

Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from a Symbolic Link Validation Insufficiency vulnerability that can be exploited by an attacke...