RHEL 9 : osbuild-composer (RHSA-2026:62754)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62754 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 9 : golang (RHSA-2026:62602)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62602 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

WebAppInstalls Component DoS

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Linux Layer 2 Tunneling Protocol DoS

The vulnerability of the l2tpxmitcore function in the net/l2tp/l2tpcore.c module, which is part of the Linux L2TP protocol implementation, is related to incorrect input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-84911

Name of the Vulnerable Software and Affected Versions GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor versions prior to 2.4.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with...

CVE-2026-84325

Google Chrome and Microsoft Edge (Chromium-based) versions prior to 152.0.7977.75 are vulnerable to a High severity security bypass due to improper input validation in the DataTransfer component. A remote attacker can leverage social engineering to bypass system access restrictions via a co-insta...

CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

CVE-2026-84357

Improper input validation in the Omnibox component of Google Chrome (prior to version 152.0.7977.75) allows a remote attacker to bypass web origin policy using crafted network traffic and social engineering. This vulnerability also affects Microsoft Edge and Chromium -based browsers. Potential im...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84477

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that diffe...

Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477

AVideo is vulnerable to a stored XSS in its live scheduling feature. The functions Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can subsequently access remindMe...

CVE-2026-84640

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...