CVE-2026-90860

Canva Mobile App for HarmonyOS prior to v1.15.1 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . The underlying cause is an insufficient origin check on WebView responses, allowing a threat actor with control of the WebView to read a user's session ...

CVE-2026-85094

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

PT-2026-68329

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description The shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses using http.ReadResponse over an unrestricted buffered reader. This allows a malicious or compromised proxy, or an...

The vulnerability of the bfd_elf32_swap_phdr_in function in the GNU Binutils development environment allows a attacker to trigger a service failure.

The vulnerability of the bfdelf32swapphdrin function in the GNU Binutils development toolset is related to buffer overflows due to the lack of restrictions on the number of headers. Exploiting this vulnerability could allow an attacker to cause a service failure...