CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299: Missing Authorization

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-84585

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...

CVE-2026-43737

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent...

CVE-2026-43737

An authorization issue in the CoreMotion framework (specifically affecting watchOS 27 ) allows an application to access motion data from headphones without user consent. This vulnerability was addressed by improving validation processes. Affected products include iOS 26.7/27 , iPadOS 26.7/27 , ma...

CVE-2026-43737

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent...

CVE-2026-43737

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent...

CVE-2026-84585

A permissions issue in macOS (specifically affecting Golden Gate 27 ) allows an application to access local network devices without user consent. This vulnerability stems from a flaw in state management . The issue has been addressed with improved state management and is fixed in macOS Golden Gat...

EUVD-2026-78008

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...

CVE-2026-84585

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in PWA implementations in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent, through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in bluez

Bluetooth HID Hosts in BlueZ may allow an unauthenticated peripheral role HID device to initiate and establish an encrypted connection, and to accept HID keyboard reports. This could potentially allow the injection of HID messages when no user interaction has occurred in the Central role, thereby...

PT-2026-91640

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...

PT-2026-91494

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent...

CVE-2026-28606

A logic error in AdapterService.java within the handleBondStateChanged function allows an attacker to skip pairing. This vulnerability could lead to a remote escalation of privilege without user consent and requires no additional execution privileges or user interaction. Remediation is available ...

ASB-A-495543559

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

Malicious code in hyperliquid-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2b7d17a47aa4fcd585374f33063197f52d6ba8619e4105ae5a1d30331bb62 bin/cli.js also declared as the package main collects the installer's username via whoami / os.userInfo, plus os.hostname and platform, and POSTs the...

MAL-2026-13504 Malicious code in dolyame-ui-attachfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8 On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a...

Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ba9319e9ab791d3944f19baaae57aac3c2d381bf03ccf736d8ae09a2ba4b6 On any require of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under...

Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...