CVE-2026-106366

Google Chrome on Android versions prior to 155.0.8059.39 is vulnerable to a high-severity security flaw. The issue stems from incomplete cleanup in CustomTabs , which allows a remote attacker to bypass web origin policy by hosting a crafted HTML page. No specific exploit code or in-the-wild explo...

BIT-GITLAB-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

gryph

Los agentes de codificación con IA no tienen límites de seguridad. Gryph está construyendo uno. Todo el mundo ejecuta en modo YOLO. Gryph aplica barandillas de protección y mantiene el registro de auditoría. Inicio Rápido · Demo · Agentes Compatibles · Casos de Uso · Política de Seguridad Los...

CVE-2026-54477

CVE-2026-54477: Panel de administración sin cabeceras de seguridad clickjacking / XSS Aviso Campo| Valor ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medio Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

CVE-2026-105782

A flaw was found in Scrapy. A remote attacker controlling a malicious website can cause a Denial of Service DoS by providing a specially crafted Referrer-Policy HTTP response header. When processing the response, the RefererMiddleware treats the header value as a Python import path and executes t...

Rubrics-as-an-Attack-Surface

Rúbricas como superficie de ataque: Deriva de preferencias sigilosa en jueces LLM 📊 Dataset • 🤖 Modelos entrenados • 📝 Artículo • 💻 Repositorio Este repositorio contiene el código del artículo Rubrics as an Attack Surface: Stealthy Preference Drift in LLM Judges de Ruomeng Ding, Yifei Pang, He Su...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Este PoC demuestra cómo un atacante puede encadenar Orange Tsai's CVE-2024-4577 con DNS rebinding para lograr ejecución remota de código en infraestructura de red interna directamente a través del navegador web de la víctima. Al eludir la Política del Mismo Origen SOP y...

CLEANSTART-2026-FK38157 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the temporal-server package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

DEBIAN-CVE-2026-105782

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object,...

CVE-2026-105782

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object,...

CVE-2026-106353: Improper Input Validation

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. Chromium security severity: Low...

CVE-2026-106216: Cross-Site Request Forgery (CSRF)

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107207

An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role...

PT-2026-107100

Name of the Vulnerable Software and Affected Versions Hydra versions 1.3.4 through 1.3.6 Hydra versions 1.4.0.dev1 through 1.4.0.dev9 Description Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker controlling...

PT-2026-107177

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

PT-2026-106864

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106396: Improper Input Validation

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-107210

A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service...

PT-2026-107198

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary...

PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...