SUSE CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87551

Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

SUSE CVE-2026-87561

Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

SUSE CVE-2026-87571

Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

SUSE CVE-2026-87573

Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87577

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87598

Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-87608

Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

SUSE CVE-2026-87614

Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-87622

Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87626

Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

SUSE CVE-2026-87632

Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87646

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-89574

Name of the Vulnerable Software and Affected Versions career-ops versions prior to 0.8.0 Description The local web dashboard web/ exposes /api routes that allow command spawning and user-file writing without validating the request origin or restricting clients to loopback addresses. This allows...

PT-2026-89295

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

CVE-2026-81635: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

PT-2026-89585

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

PT-2026-89410

Name of the Vulnerable Software and Affected Versions LIBRID/LIBREF versions 2.01.0.2183 through 18.9.26.2319 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts are permanently stored on the targe...

CVE-2026-88061: Cross-Site Request Forgery (CSRF)

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...