CVE-2026-79050

A flaw was found in Google Chrome's Network component. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. The attacker can achieve this by enticing a user to open a specially crafted HTML page. This could lead to unauthorized access to system...

ROS-20260925-73-0179

The vulnerability of the bpf component in the Linux operating system’s kernel is related to insufficient checking of the type of input data provided. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-99135

Name of the Vulnerable Software and Affected Versions Horilla versions 1.5.0-85 and earlier Description An authentication bypass exists in the payroll module where the system fails to consistently authorize access before loading records. An authenticated employee can manipulate identifiers to...

PT-2026-98867

Name of the Vulnerable Software and Affected Versions Gnumeric affected versions not specified Description A heap use-after-free flaw exists where the XML parser can dereference a freed sheet-object component. This occurs when a user opens a specially crafted workbook containing a malformed...

Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Overview Three cross-site scripting XSS vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successf...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenJDK 25 vulnerabilities (USN-8783-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8783-1 advisory. Weber Leon discovered that the 2D component of OpenJDK 25 did not correctly handle user authentication. A remote attacker could...

PT-2026-98520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rkvdec media component where the compute tiles uniform and compute tiles non uniform functions loop over entries based on num tile columns minus1 + 1 and num tile...

camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Navigation component...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

firefox: thunderbird: Use-after-free in the DOM: Streams component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Streams component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

firefox: thunderbird: Use-after-free in the XML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

firefox: thunderbird: Use-after-free in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking component...

CVE-2026-91122

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

Astra Linux – Vulnerability in Chromium

Using “after free” in the Network component of Google Chrome before version 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...