EulerOS 2.0 SP13 : perl-libwww-perl (EulerOS-SA-2026-3037)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

EulerOS 2.0 SP13 : perl-libwww-perl (EulerOS-SA-2026-2987)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

PT-2026-68712

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description An integer overflow in the GPU component allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved by inducing the browser t...

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Summary The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain: - a same-host HTTPS-to-HTTP redirect preserves Authorization:...

CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70600

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling...

CVE-2026-70599

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of...

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...

GHSA-V3J7-R9GQ-3GJW Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...

CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70604

In Electron, a vulnerability affects custom schemes registered with supportFetchAPI: true but without corsEnabled: true. Prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0, such schemes were not subject to CORS enforcement, allowing a page loaded from a remote origin to fetch() or XMLHttpReque...

Improper Restriction of Rendered UI Layers or Frames

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the handling of cross-origin iframes, which allows...

GHSA-X8RC-WPG4-GRPF Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

NPM: Electron: Cross-origin iframe can position native autofill popup

NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

Improper Restriction of Rendered UI Layers or Frames

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the handling of cross-origin iframes, which allows the native...