SUSE CVE-2026-95289

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95296

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95297

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95302

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

SUSE CVE-2026-95312

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95317

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

SUSE CVE-2026-95340

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95342

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95352

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

SUSE CVE-2026-95361

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95366

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95368

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95374

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95375

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the RefererFilter process. An attacker can bypass security checks by providing weaker-than-origin evidence in HTTP requests. Remediation Upgrade org.apache.sling:org.apache.sling.security to version 1.3.2 or...

EUVD-2026-85182

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue...

CVE-2026-94243 Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue...

CVE-2026-94243

The Apache Sling Security Bundle is vulnerable to a security flaw where the ReferrerFilter accepts weaker-than-origin evidence. This issue affects all versions before 1.3.2 . To remediate this vulnerability, users are recommended to upgrade to version 1.3.2 . No specific exploit details or in-the...