CVE-2026-19161

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

firefox: thunderbird: Site isolation issue in the Networking: HTTP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component...

firefox: thunderbird: Site isolation issue in the Networking: HTTP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component...

firefox: thunderbird: Site isolation issue in the Networking: HTTP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component...

firefox: thunderbird: Site isolation issue in the Networking: HTTP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

Improper Cross-Origin Resource Sharing (CORS) Configuration

Apache Helix is vulnerable to Improper Cross-Origin Resource Sharing CORS Configuration. The vulnerability is due to the REST API allowing arbitrary origins and credentials through permissive CORS headers, which allows an attacker controlling a malicious webpage to issue cross-origin requests and...

CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

CVE-2026-66773

CVE-2026-66773 describes a vulnerability where a server-controlled __next URL in an OData service can disclose sensitive authentication information and inject untrusted data due to cross-origin checks not being applied. The impact is stated as high impact on confidentiality and low impact on inte...

CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

PT-2026-70045

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application. This issue involves...

PT-2026-70844

Name of the Vulnerable Software and Affected Versions Claude Code Templates versions prior to 1.29.4 Description The Claude Code Studio server, launched via the --studio option, binds to all interfaces on port 3444, allows cross-origin requests, and lacks authentication. The POST /api/execute...

CVE-2025-71381

A flaw was found in Hono's Cross-Origin Resource Sharing CORS middleware. When the origin is not set to a wildcard, the middleware improperly copies the Vary header from incoming requests into the response. This allows an attacker to inject arbitrary Vary values, potentially leading to cache key...

VulnCheck KEV: CVE-2026-48294

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...

EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2026-3152)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2026-3098)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

SUSE CVE-2026-19160

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...