firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CLEANSTART-2026-NZ56993 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the aws-network-policy-agent package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2026-12962

ASUS Armoury Crate is affected by a permissive cross-domain security policy that allows untrusted domains to interact with the application's local service endpoint. A remote attacker can obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request contai...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

EUVD-2026-72626

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2026-66768

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

EUVD-2026-72577

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

PT-2026-87213

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

PT-2026-88698

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the ServiceWorker allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-88536

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incomplete cleanup in the Browser component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from o...

PT-2026-88650

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper encoding or escaping of output in CSS allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or scrip...

PT-2026-88677

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Isolated component allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one...

PT-2026-86968

Name of the Vulnerable Software and Affected Versions Armoury Crate affected versions not specified Description A permissive Cross-domain Security Policy with untrusted domains allows a remote user to obtain a local user's NTLM hash. This occurs when a user is convinced to visit a crafted web pag...

PT-2026-87677

Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

PT-2026-88542

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Prerender component allows a remote attacker who has compromised the renderer process to potentially bypass the web origin policy using a crafted HTML pag...