EUVD-2026-68216

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 contain an arbitrary directory creation vulnerability in the run_agent_task function. The affected parameters (save_recording_path , save_trace_path , save_agent_history_path , save_download_path ) accept unvalidated absolute paths, and the attack i...

EUVD-2026-68213

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

PT-2026-83557

Name of the Vulnerable Software and Affected Versions browser-use web-ui versions 2.0.0 through 3.0.0 Description The software fails to validate browser settings paths within the run agent task function. This allows unauthenticated users to create directories at arbitrary locations on the system...

CVE-2026-78610

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-78008

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service DoS condition or potentially execute arbitrary code by sending specially crafted network traffic...

CVE-2026-78610

WatchGuard Dimension 's Web UI contains a Cross-Site Request Forgery (CSRF) vulnerability in the administrator passphrase change endpoint. Because the action lacks CSRF protection, an attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can chang...

CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

Astra Linux – Vulnerability in Chromium

In WebUI Settings of Google Chrome before version 89.0.4389.72, an out-of-bounds memory read was allowed, enabling a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chrome security severity: Low...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Web UI Settings of Google Chrome prior to version 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

[SECURITY] [DSA 6454-1] sabnzbdplus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6454-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 20, 2026 https://www.debian.org/security/faq -...

CVE-2026-18372

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18372

M-Files Web before version 26.8.16330.2 is affected by a CSS injection vulnerability. An authenticated vault administrator can inject arbitrary CSS into the web user interface displayed to other vault users, resulting in low integrity impact on both the vulnerable and subsequent systems. The CVSS...

CVE-2026-18372 CSS injection in M-Files Web

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...