CVE-2026-63431

The HR and CRM software Horilla (version 1.5.0-85 and earlier) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the payroll/views/component_views.py component. The application fails to consistently authorize access to the allowances_deductions_tab, view_single_allowance, an...

CVE-2026-63431 Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...

EUVD-2026-87258

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

Chromium CVE-2026-95277: Use after free in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-78909

A flaw was found in Google Chrome. This use-after-free vulnerability in the Views component allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by leveraging social engineering tactics to entice a user to visit a specially crafted HTM...

CVE-2026-63432: Improper Control of Generation of Code

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63431: Missing Authorization

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...

PT-2026-99136

Name of the Vulnerable Software and Affected Versions Horilla versions 1.0.0 through 1.5.9 Horilla version 2.0.0 affected versions not specified Description The get mail preview handlers in recruitment/views/actions.py and employee/not in out dashboard.py render a user-controlled body at the...

PT-2026-99135

Name of the Vulnerable Software and Affected Versions Horilla versions 1.5.0-85 and earlier Description An authentication bypass exists in the payroll module where the system fails to consistently authorize access before loading records. An authenticated employee can manipulate identifiers to...

Astra Linux – Vulnerability in Chromium

The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-95277

Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-95351

Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-95371

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-95351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...

PT-2026-97508

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description Four debug views that trigger internal task, dependency, and workflow schedulers are accessible to any user, including unauthenticated client...

Linux Distros Unpatched Vulnerability : CVE-2026-95277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafte...

Google Chrome < 154.0.8037.57 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 154.0.8037.57. It is, therefore, affected by multiple vulnerabilities as referenced in the 202609stable-channel-update-for-desktop0856730748 advisory. - Use after free in DevTools. CVE-2026-95373 - Improper output encodin...

Google Chrome < 154.0.8037.57 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 154.0.8037.57. It is, therefore, affected by multiple vulnerabilities as referenced in the 202609stable-channel-update-for-desktop0856730748 advisory. - Use after free in DevTools. CVE-2026-95373 - Improper output...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...