CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images before 15.4.0, helm chart before 10.4.0), when fetching package versions from a NuGet registry , Renovate follows pagination URLs returned in the HTTP Link header without verifying the targ...

USN-8740-1: .NET vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...

USN-8740-1 dotnet8, dotnet10 vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...

PT-2026-89398

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

PT-2026-89393

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

PT-2026-89585

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

PT-2026-89574

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

CVE-2026-87521

A flaw was found in WebMCP in Chromium. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive cross-origin data...

CVE-2026-87451

A flaw was found in Google Chrome. This information leak vulnerability in the Downloads component allows a remote attacker, who has already compromised the browser's renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML...

CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87642

A flaw was found in WebGL within Chromium. An uninitialized resource vulnerability allows a remote attacker to leak sensitive cross-origin data. This can be exploited by enticing a user to visit a specially crafted HTML page...

CVE-2026-87495

A flaw was found in chromium-browser. A remote attacker, who has compromised the renderer process, could exploit a vulnerability in the Scroll component by crafting a malicious HTML page. This could lead to the leakage of sensitive cross-origin data...

CVE-2026-87563

A flaw was found in Paint in Google Chrome. An origin validation error allows a remote attacker to obtain sensitive cross-origin data by enticing a user to visit a specially crafted HTML page. This vulnerability could lead to information disclosure...

CVE-2026-87466

A flaw was found in Chromium. Incorrect authorization within the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actio...

CVE-2026-87658

A flaw was found in Google Chrome's Extensions component. A remote attacker could exploit this vulnerability by leveraging social engineering techniques and a specially crafted Chrome extension. This could lead to an information leak, allowing the attacker to obtain sensitive data from other...

CVE-2026-87511

A flaw was found in DevTools in Google Chrome. Missing authorization in this component allows a remote attacker to obtain sensitive cross-origin data. This can be achieved by exploiting the vulnerability with a specially crafted Chrome extension...

CVE-2026-87611

A flaw was found in Google Chrome. Missing authorization in the FileSystem component allows a remote attacker, who has already compromised the renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-87651

A flaw was found in Google Chrome's Paint component. This incorrect authorization vulnerability allows a remote attacker to obtain sensitive cross-origin data by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to information from other web origins...