Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

USN-8752-1: Konsole vulnerability

It was discovered that Konsole incorrectly handled certain URLs under specific circumstances. A remote attacker could possibly use this issue to execute arbitrary code...

USN-8752-1 konsole vulnerability

It was discovered that Konsole incorrectly handled certain URLs under specific circumstances. A remote attacker could possibly use this issue to execute arbitrary code...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

SUSE-SU-2026:4144-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...

CVE-2026-88852

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

CVE-2026-85189

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path...

CVE-2026-88852

CVE-2026-88852 is a privileged stored XSS in the Snippets Free (Joomla < 7.0.0) and Snippets Pro (Joomla

CVE-2026-88852 Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

CVE-2026-88852 Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields

A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service DoS for all connections. The vulnerability occurs...

CVE-2026-85189 Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path...

CVE-2026-85189

The Modals extension for Joomla by regularlabs.com (versions

EUVD-2026-77312

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path...

CVE-2026-85189 Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path...

python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields

A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service DoS for all connections. The vulnerability occurs...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...