CVE-2026-113799 Slack Morphism verifier errors disclose valid HMACs in the logs

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

CVE-2026-113799

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, "slack-morphism" computes the correct signature for the attacker-controlled timesta...

CVE-2026-113799

The Slack Morphism client library (versions 1.0.0 through 2.27.0 ) contains a vulnerability where signature verification failures disclose valid HMACs in application logs. Specifically, the slack-morphism library computes the correct signature for an attacker-controlled request body and stores it...

EUVD-2026-107388

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

CVE-2026-113799 Slack Morphism verifier errors disclose valid HMACs in the logs

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

raspi-corelight

Corelight@Home raspi-corelight v3.2 Configure the Pi to Run Corelight Software Sensor The Corelight Software Sensor is a 64-bit application, so we have created a configuration tool raspi-corelight to perform initial configuration of the sensor and Raspberry Pi OS. To install and run this tool,...

CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798

The Electron framework is vulnerable to an Origin Validation Error (CWE-346) in versions prior to 42.11.9 , 43.7.6 , 44.5.0 , and 45.0.0-alpha.13 . The root cause is that pointerLock permission requests from certain cross-origin iframes incorrectly cause session.setPermissionRequestHandler() to r...

CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-104355

A flaw was found in Temporal Server. In a multi-cluster deployment, the server fails to verify whether inbound replication tasks apply only to global namespaces. An attacker controlling a connected peer cluster can exploit this vulnerability by sending replication updates that overwrite...

CVE-2026-113797

The Electron framework, prior to versions 42.11.1 , 43.5.1 , 44.1.1 , and 45.0.0-alpha.4 , contains a vulnerability where the chrome.tabs.query() function returns the URL and title of every tab to extensions lacking the tabs permission or matching host permissions. This allows an untrusted extens...

CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query returned each tab's url and title to extensions that had neither the tabs permission nor matching host...

CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query returned each tab's url and title to extensions that had neither the tabs permission nor matching host...

CVE-2026-113797

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query returned each tab's url and title to extensions that had neither the tabs permission nor matching host...

CVE-2026-114097

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into running branch filtering operations on a specially crafted Git repository. Because temporary files persist between commit processing cycles, symbolic links created in...

CVE-2026-114102

A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service DoS by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the inval...

autonoma

Autonoma Autonoma detects hardcoded secrets and replaces them withos.environ... references using AST rewrites. Changes are applied only when the rewrite is deterministic and semantically-preserving. Rewrites use the parsed syntax tree — not regex on raw text. Runs locally with no network calls...

CVE-2026-20643

CVE-2026-20643 CVE-2026-20643 test page diff: https://github.com/WebKit/WebKit/commit/850ce3163e55ebaa33f712d05681e5522b518806 https://www.flvin.com/blogs/2026/03/20/CVE-2026-20643/...

CVE-2026-113796

The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...