CVE-2026-95368

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95317

An incorrect authorization flaw exists in the MediaCapture component of the Chromium browser (Google Chrome) prior to version 154.0.8037.57 . A remote attacker could leverage social engineering to use a crafted Chrome extension to obtain cross-origin data . Remediation involves updating the softw...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

CVE-2026-76719

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

CVE-2026-76719

A security vulnerability exists in HPE OneView and HPE Synergy Composer (prior to v11.40 ) that may be exploited remotely. The vulnerability allows for Cross-Site Scripting (XSS) and URL Redirection , which can lead to session hijacking , data theft , or other unauthorized actions. The CVSS v3.1 ...

CVE-2026-76719 HPE OneView - Cross-site scripting vulnerability

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

CVE-2026-76719 HPE OneView - Cross-site scripting vulnerability

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

EUVD-2026-88698

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation

Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," the Politie Landelijke Opsporing en...

CVE-2026-102372

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

EUVD-2026-88596

GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

CVE-2026-102372 GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

CVE-2026-102372 GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMAP Connector

GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

EUVD-2026-88566

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

PT-2026-102495

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

CVE-2026-102372: Improper Neutralization of Input During Web Page Generation

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

CVE-2026-76719: Improper Neutralization of Input During Web Page Generation

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

CVE-2026-95317: Incorrect Authorization

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-102333

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their...