CVE-2026-79082

A flaw was found in the Transactions Platform of Google Chrome. An attacker who has compromised the renderer process could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow them to bypass the web origin policy, potentially leading to unauthorized...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...

CVE-2026-79285

A flaw was found in ANGLE, a component used by Google Chrome. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to obtain sensitive cross-origin data, leading to information disclosure...

CVE-2026-79255

A flaw was found in WebRTC, a real-time communication component within Chromium. This improper input validation vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This bypass can be achieved by tricking the user into visiting...

CVE-2026-79252

A flaw was found in the ServiceWorker component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive data from other websites cross-origin...

SUSE-SU-2026:23361-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...

CVE-2026-48549

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute...

CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...

CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...

SUSE-SU-2026:23350-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...

Signal-Desktop v8.25.0-beta.2

Signal Desktop Signal Desktop links with Signal on Android or iOS and lets you message from your Windows, macOS, and Linux computers. Install the production version or help us out by installing the beta version. Got a question? You can find answers to a number of frequently asked questions on our...

CVE-2026-54523

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

Missing Authorization

Overview openwisp-ipam is an IP address space administration module of OpenWISP. Affected versions of this package are vulnerable to Missing Authorization via the ExportSubnetView process. An attacker can access sensitive information belonging to other organizations by submitting an export reques...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Impact A cookie tossing / cookie injection issue CWE-1275. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain RFC 6265 §5.3 step 6. A host the client connects to can therefore plant a...

CVE-2026-78961

A flaw was found in Google Chrome's core functionality. A remote attacker, who has already compromised a part of the browser responsible for rendering web content the renderer process and used social engineering tactics, could bypass the security mechanism that isolates content from different...

CVE-2026-78965

A flaw was found in ANGLE, a component used in Google Chrome. A remote attacker could exploit an uninitialized resource vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to obtain sensitive cross-origin data, leading to information...

CVE-2026-79205

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the browser's Network component allows a remote attacker to bypass the web origin policy. By enticing a user to open a specially crafted HTML page, an attacker could potentially gain unauthorized access to sensitive...