CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702

Grav CMS versions before 2.0.16 contain an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods. The root cause is an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter, meaning an attacker who controls a domain that begins ...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefo...

gstreamer1-plugins-base security update

1.16.1-6.0.1.el810.1 - Update origin URL Orabug: 36209826 1.16.1-6.1 - Add patch for CVE-2026-18297 Resolves: RHEL-246576...

CVE-2026-79185: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78965: Use of Uninitialized Resource

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79238: Incorrect Authorization

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-79212: Missing Authorization

Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-81612

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in the Autofill component allows a remote attacker who has already compromised the renderer process to bypass the web origin policy. This is achieved by using a special...

CVE-2026-79144: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79117: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. Chromium security severity: High...

CVE-2026-79123: Improper Input Validation

Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78980: Improper Input Validation

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

PT-2026-81765

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in the Network component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-81498

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row API when a deep image has a...

PT-2026-81419

Name of the Vulnerable Software and Affected Versions OpenEXRUtil versions 3.3.0 through 3.3.12 OpenEXRUtil versions 3.4.0 through 3.4.12 Description The TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. This occurs because...

CVE-2026-79116: Missing Authorization

Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...