CVE-2026-14141

An incorrect security ui flaw was found in the Document Picture-in-Picture component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514072867...

CVE-2026-15768

An insufficient policy enforcement flaw was found in the HTML-in-Canvas component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517931625...

CVE-2026-66053

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

Confidential Computing on CPU and GPU Systems: How AI Data Centers Protect Data in Use

Modern AI runs on shared, high-performance infrastructure that processes enormous volumes of sensitive data and valuable model weights.…...

CVE-2026-61376

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-59896

A flaw was found in Hono, a Web application framework. The hono/jsx component did not properly isolate context values per request during server-side rendering. This allowed data from a different in-flight request to be used after an asynchronous operation in a component. This could lead to...

CVE-2026-61376

CVE-2026-61376 affects ELECOM wireless LAN routers and access points. The flaw is an OS Command Injection in the Restore Settings function, allowing an attacker who can log in to the product to execute arbitrary OS commands. Connected documents confirm the vulnerability and generic impact (arbitr...

CVE-2026-44387

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in the DOM: Navigation...

A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skbtrycoalesce can attach paged frags from @from to @to. If @from has SKBFLSHAREDFRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backe...

FreeBSD : Erlang/OTP -- (D)TLS-1.2 server certificate verification bypass (445c61c0-89e1-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445c61c0-89e1-11f1-b35c-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 reports: The OTP TLS/DTLS client...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

EUVD-2026-49629

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs...

CVE-2026-64783

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash...

EUVD-2026-49586

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslas...

CVE-2026-55579

CVE-2026-55579 affects the PHP single-file editor Pheditor. From 2.0.1 up to before 2.0.6, it ships with a hardcoded default password (admin) whose SHA-512 hash is in pheditor.php:11, with no mechanism to force a first-login password change. An attacker using the default credentials gains full ac...