SUSE CVE-2026-79120

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79144

Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79146

Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

SUSE CVE-2026-79193

Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79252

Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79258

Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-82542

Name of the Vulnerable Software and Affected Versions DoXBASE versions prior to 27082026 Description Improper neutralization of input during web page generation leads to a cross-site scripting XSS flaw, which allows Cross Zone Scripting. Cross-site scripting is a type of security flaw where...

PT-2026-82464

Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...

PT-2026-82423

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as created by an...

OpenRGB: Multiple Vulnerabilities

Background OpenRGB is a cross-platform software suite for controlling RGB LED lighting devices. Description Multiple vulnerabilities have been discovered in OpenRGB. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

TencentOS Server 3: resource-agents (TSSA-2026:0899)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0899 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

AlmaLinux 9 : golang (ALSA-2026:60304)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

PT-2026-82466

Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...

PT-2026-82470

Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...

PT-2026-82455

Name of the Vulnerable Software and Affected Versions Fluent Boards Pro versions prior to 2.0.12 Description Cross Site Scripting XSS exists in the software, allowing users with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to version...

CVE-2026-75814: Cross-Site Request Forgery (CSRF)

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

CVE-2026-81092: Origin Validation Error

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-78283: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

PT-2026-82459

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

PT-2026-82624

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...