CVE-2026-81931

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

AZL-98042 CVE-2026-18374 affecting package glibc 2.38-21

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

UBUNTU-CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

CVE-2026-81931

Roskus Prospero Flow CRM before 5.16.0 is affected by an unrestricted file upload in the product photo feature. The validation logic checks only magic bytes and blocks a fixed list of PHP extensions , but ProductSaveController::save() stores the file using the client-supplied extension in the pub...

EUVD-2026-67225

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-18374

CVE-2026-18374 affects the GNU C Library (glibc) version 2.45 or earlier . The vulnerability is a heap buffer overflow in the fopen function triggered by passing an effectively empty string to the ,ccs= syntax extension of the mode argument, when that input is attacker-controlled. The CVSS 3.1 sc...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77990 Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events...

CVE-2026-77990

Joomla Event Manager (a Joomla extension) before 5.0.1 contains an access control flaw in its attendee list feature. Any logged-in user who is not the event manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including those belonging to unp...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

SUSE CVE-2026-79017

Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Low...

SUSE CVE-2026-79266

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-79238

A flaw was found in ServiceWorker in Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted Chrome extension, to bypass the web origin policy. Bypassing the web origin policy could lead to unauthorized...

CVE-2026-79226

A flaw was found in chromium-browser. This vulnerability, related to improper privilege management in Regional Capabilities, allows a remote attacker to bypass system access restrictions. By leveraging social engineering and a crafted Chrome extension, an attacker can gain unauthorized access...

CVE-2026-79137

An incorrect authorization flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=505951430...

CVE-2026-79176

A flaw was found in Google Chrome. This user interface UI misrepresentation in the Extensions feature allows a remote attacker to leverage social engineering techniques. By tricking a user into installing a specially crafted Chrome extension, the attacker can obtain sensitive information from the...

CVE-2026-79266

A flaw was found in chromium-browser. A remote attacker, by leveraging social engineering tactics and a specially crafted Chrome extension, could exploit a use-after-free vulnerability in DevTools. This could lead to the execution of arbitrary code within the browser's sandbox environment...