Nextcloud: position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.

A vulnerability was discovered in the CSS sanitization process of the Roundcube webmail application. The sanitizer failed to properly handle the "position: fixed !important" CSS declaration, allowing an attacker to bypass the mitigation for fixed-position overlays. This could enable the creation ...

Malicious code in @get-wrecked/overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f69fb73aa68e8345f0c5b8a87578c3eac0a11576be46084e983aa24d911f07 The package @get-wrecked/overlay was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1241 Malicious code in @get-wrecked/overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f69fb73aa68e8345f0c5b8a87578c3eac0a11576be46084e983aa24d911f07 The package @get-wrecked/overlay was found to contain malicious code. Source: ghsa-malware...

CVE-2026-0007

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0007

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0007

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Android 安全漏洞

Google Android is an open-source operating system based on Linux, developed by Google Inc. There are security vulnerabilities in Google Android, which stem from clickjacking or overlay attacks, potentially leading to local privilege escalation...

ASB-A-433251166

Bulletin has no description...

container-tools:ol8 security update

aardvark-dns 2:1.10.1-2 - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah 2:1.33.14-2 - rebuild for CVE-2025-61729 - Resolves: RHEL-140529 cockpit-podman 84.1-1 - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 - Related: Jira:RHEL-25557 conmon...

podman security update

5.6.0-14.0.1 - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount Orabug: 36234694 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.6.0-14 - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146869...

podman security update

5.6.0-12.0.1 - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount Orabug: 36234694 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 7:5.6.0-12 - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146727...

openSUSE Security Advisory (SUSE-SU-2026:0377-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15: gdk-pixbuf-loader-libheif / libheif-devel / libheif1 / etc (SUSE-SU-2026:0377-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0377-1 advisory. - CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735 Tenable has...

Security update for libheif

This update for libheif fixes the following issues: CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:0377-1 Security update for libheif

This update for libheif fixes the following issues: - CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735...

SUSE: Security Advisory (SUSE-SU-2026:20121-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for libheif (moderate)

openSUSE security update: security update for libheif ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20076-1 Rating: moderate References: bsc1255735 Cross-References: CVE-2025-68431 CVSS scores: CVE-2025-68431 SUSE : 5.5...

Medium: libheif

Issue Overview: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay. The function computes a negative row length likely from an unclipped overlay...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1363)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1363 advisory. libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in...

OPENSUSE-SU-2026:20076-1 Security update for libheif

This update for libheif fixes the following issues: - CVE-2025-68431: heap buffer over-read in HeifPixelImage::overlay via crafted HEIF file that exercises the overlay image item path bsc1255735...