CVE-2026-94181

Affected versions of the Arc browser are susceptible to an address bar spoofing issue. An attacker can spoof the browser address bar by utilizing a element that triggers requestFullscreen without displaying the standard fullscreen notification. Exploitation details are not provided in the docume...

EUVD-2026-85565

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

SUSE CVE-2026-95279

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95291

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-95320

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95323

UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a butto...

php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-57222

A flaw was found in Suricata. This vulnerability allows a remote attacker to cause an incorrect detection state by sending specially crafted IPv4 and IPv6 address pairs. The flaw occurs because the system's IPPair hash does not properly compare the IP address family, leading to the reuse of state...

CVE-2026-89331

The FluentBoards WordPress plugin (versions 1.95-2.0.15 ) is vulnerable to an unauthenticated board member email address disclosure vulnerability. The flaw exists because the plugin fails to properly restrict member data returned by its public, token-shared board feature . This allows unauthentic...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

WordPress FluentBoards plugin 1.95-2.0.15 - Unauthenticated Board Member Email Address Disclosure vulnerability

Unauthenticated Board Member Email Address Disclosure vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 1.95-2.0.15...

CVE-2026-14321

The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

EUVD-2026-85023

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators...

EUVD-2026-85020

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...