webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, resulting in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds write due to improper memory handling, resulting in an unexpected process crash...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds read due to improper bounds checking, resulting in an unexpected process crash...

Malicious code in js-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500 On module load, src/api/session-api.js reads../../../../public/logo.ico a path outside the package, DES-decrypts the contents with the hardcoded key...

Origin Validation Error

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Origin Validation Error in the referrer process. An attacker can gain unauthorized access or perform actions as a trusted origin by supplying ...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

DEBIAN-CVE-2026-55059

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-55059

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

CVE-2026-79229: Use of Uninitialized Resource

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78958: Use of Uninitialized Resource

Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

JSONata environment lookup Code Execution

The vulnerability of the environment.lookup function in the childprocess module of the json-data processing tool JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-79112: Out-of-bounds Read

Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Low...

PT-2026-81665

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in the Network component of the renderer process. A remote attacker who has already compromised the renderer process can use a crafted HTML page to obtain...

PT-2026-81525

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in the Payments component allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. A race condition occu...

PT-2026-81553

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak in the Core component allows a remote attacker who has compromised the renderer process to bypass site isolation. This is achieved by using a crafted HTML page. Site...

PT-2026-81599

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 152.0.7977.65 Description An information leak exists in the Bluetooth component. A remote attacker who has compromised the renderer process and uses social engineering can obtain sensitive information by...

PT-2026-81658

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...