CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

PT-2026-88551

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Downloads component. A remote attacker who has compromised the renderer process can obtain cross-origin data by using a crafted HTML page...

PT-2026-88751

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Paint component allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Cross-origin data refers to information belonging to a...

PT-2026-88561

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Core component that allows a remote attacker to leak cross-origin data through the use of a crafted Chrome extension. Cross-origin data refers to...

PT-2026-88674

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ServiceWorker, which allows a remote attacker to obtain cross-origin data by using a crafted HTML page. ServiceWorker is a script that the browser runs...

CVE-2026-78997

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is vulnerable to a Universal Cross-Site Scripting (UXSS) flaw. The issue stems from a reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn, which allows attackers to access the privileged ucapi JavaScript bridge. Speci...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3294)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3369)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

EulerOS 2.0 SP12 : perl-libwww-perl (EulerOS-SA-2026-3372)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

EulerOS 2.0 SP12 : perl-libwww-perl (EulerOS-SA-2026-3297)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3376)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

PT-2026-88152

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...

PT-2026-88621

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in WebMCP. A remote attacker who has compromised the renderer process can obtain cross-origin data by using a crafted HTML page. Recommendations Update Google...

PT-2026-88611

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in DevTools allows a remote attacker to obtain cross-origin data through the use of a crafted Chrome extension. Recommendations Update Google Chrome to version...

PT-2026-88711

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page...