PT-2026-81975

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

PT-2026-81974

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

CVE-2025-61163

The Cohere North AI v1.1.5 software is susceptible to an excessively permissive cross-domain policy because the server fails to properly validate the Origin header of incoming connection requests. This flaw allows untrusted domains to bypass security restrictions, potentially enabling an attacker...

CVE-2025-61163: Permissive Cross-domain Policy with Untrusted Domains

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

PT-2026-82237

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

EUVD-2025-210786

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

Linux Distros Unpatched Vulnerability : CVE-2026-79095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-79272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak...

Linux Distros Unpatched Vulnerability : CVE-2026-79034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

Linux Distros Unpatched Vulnerability : CVE-2026-79146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app...

Linux Distros Unpatched Vulnerability : CVE-2026-78936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

PT-2026-82364

Name of the Vulnerable Software and Affected Versions Drupal Slick Carousel versions 0.0.0 through 2.1.0 Description Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting XSS. The issue occurs because the module does not...

CVE-2026-39275

Cockpit CMS versions 2.13.5 and before are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) leading to Account Takeover . The root cause is the lack of output encoding when passing render() outputs to the Vue.js v-html directive within the item.php , field-select.js , and ...

EUVD-2026-66750

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

Linux Distros Unpatched Vulnerability : CVE-2026-78949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

Linux Distros Unpatched Vulnerability : CVE-2026-78894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

PT-2026-82066

Name of the Vulnerable Software and Affected Versions TarsWeb affected versions not specified Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user...

Linux Distros Unpatched Vulnerability : CVE-2026-79258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via...