Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, reading out of bounds in ANGLE using Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

...

poxiao

PoXiao v3.0.0 Twenty-Four Solar Safety Toolchain — SRC Ho...

What AI Red-Team Evaluations Can and Cannot Prove

Red-team evaluations of AI models support some claims and not others, and the boundary between the two is calculable rather than merely a matter of judgment. We define the evidential ceiling of an evaluation as the largest factor by which one result can move belief under a fixed testing budget,...

PT-2026-64078

Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmin tokens.json was created world-readable 0o644. The file contains the DI...

Linux HSI ssi_probe Heap Buffer Overflow DoS

The vulnerability of the ssiprobe function in the drivers/hsi/controllers/omapssicore.c file of the Linux high-speed synchronous serial interface driver core is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

Stable Channel Update for Desktop

The Stable channel has been updated to 150.0.7871.186/.187 for Windows and Mac and 150.0.7871.186 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

Fedora 43 : kernel (2026-6503a6a639)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6503a6a639 advisory. The 7.1.4-104/204 stable kennel updates contain a couple of security fixes for issues with exploits in the wild. Tenable has extracted the preceding...

Fedora 43 : collectl (2026-e2b3dd1ec0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e2b3dd1ec0 advisory. - handle insecure code properly in colmux Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Oracle VM VirtualBox (July 2026 CPU)

The 7.2.12 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12...

Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (12.2.1.4.0 / 14.1.2.0.0)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that a...

CVE-2026-60372

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-60368

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to...

GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...