EUVD-2026-93685

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106266

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106266

A confused deputy flaw exists in the Contextual Tasks component of the Chromium browser (Google Chrome) prior to version 155.0.8059.39 . This vulnerability allows a remote attacker who has already compromised the renderer process to bypass the web origin policy and access a privileged page using ...

CVE-2026-106381

Google Chrome on iOS versions prior to 155.0.8059.39 is vulnerable to an incorrect authorization flaw within the Passwords component. A remote attacker could exploit this by leveraging a crafted HTML page to bypass the web origin policy . The Chromium security severity for this issue is Medium . ...

CVE-2026-106365

Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93861

Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106365

A missing authorization flaw in the Animation component of the Chromium browser (Google Chrome) allows a remote attacker to bypass web origin policy via a crafted HTML page. This vulnerability affects versions prior to 155.0.8059.39 . No specific exploit details or remediation steps are provided ...

CVE-2026-106286

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

EUVD-2026-93857

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106286

A confused deputy vulnerability in the Omnibox component of Google Chrome (prior to version 155.0.8059.39 ) allows a remote attacker to bypass the web origin policy using crafted network traffic. This flaw has a Chromium security severity of Medium . Remediation is available in version 155.0.8059...

CVE-2026-106396

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93815

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106396

Improper input validation in the Omnibox component of Google Chrome on Android (versions prior to 155.0.8059.39 ) allows a remote attacker to bypass web origin policy . By leveraging social engineering and a crafted HTML page , an attacker can exploit this flaw to circumvent security boundaries. ...

EUVD-2026-93800

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106366

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106366

Google Chrome on Android versions prior to 155.0.8059.39 is vulnerable to a high-severity security flaw. The issue stems from incomplete cleanup in CustomTabs , which allows a remote attacker to bypass web origin policy by hosting a crafted HTML page. No specific exploit code or in-the-wild explo...

BIT-GITLAB-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

gryph

AI 编码代理没有安全边界。Gryph 正在构建一个。 每个人都在运行 YOLO 模式。Gryph 强制执行护栏并保留审计追踪。 快速开始 · 演示 · 支持的代理 · 使用场景 · 安全策略 AI 编码代理（Claude Code、Cursor、Windsurf、Gemini CLI、OpenCode）可以读取任何文件、写入任何位置，并在开发者机器上执行任意命令。它们每个会话会运行数十次工具调用。它们能做什么没有边界，出问题时也没有审计追踪。 Gryph 解决了这个问题。 它挂钩到代理中，实时强制执行 block、warn 或 guide 操作的 YAML 策略规则，并将每个事件记录到...

CVE-2026-54477

CVE-2026-54477：管理面板缺少安全标头（点击劫持 / XSS） 公告 字段| 值 ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03（Gardyn IoT Hub） CVSS 3.1| 5.4（中危） 向量（3.1）| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 向量（4.0）| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CWE（CISA 分配）| CWE-644（HTTP 标头脚本语法中和不当）...

CVE-2026-105782

A flaw was found in Scrapy. A remote attacker controlling a malicious website can cause a Denial of Service DoS by providing a specially crafted Referrer-Policy HTTP response header. When processing the response, the RefererMiddleware treats the header value as a Python import path and executes t...