SUSE CVE-2026-17856

Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17866

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17890

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17916

Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17945

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17946

Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17987

Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Low...

SUSE CVE-2026-17990

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Low...

SUSE CVE-2026-17997

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-18006

Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Malicious code in create-backend-scaffold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...

MAL-2026-11328 Malicious code in logform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

MAL-2026-11193 Malicious code in litespeed-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3af61c30e0a85b26bb59e521eb02a26c0b7071446d99d03cdf6b07f790b1f8 This npm package a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module ships a preinstall script and a top-level...

CVE-2026-59328

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

DEBIAN-CVE-2026-18006

Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18004

Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18006

Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-18004

Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...