SUSE CVE-2026-100816

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

SUSE CVE-2026-100821

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2025-68613

CVE-2025-68613 — n8n 工作流自动化表达式引擎隔离失效 作者不对因使用或滥用本研究造成的任何损害承担责任 严格仅供教育和防御用途 描述 本仓库包含对漏洞 CVE-2025-68613 的实验室级分析和安全概念验证 ，该漏洞影响工作流自动化平台 n8n 。 从 0.211.0 开始到 1.120.4 之前的版本，以及 1.121.0–1.121.1 包含一个 表达式评估系统 中的严重缺陷。 在特定条件下，由经过身份验证的用户提供的表达式可能会在缺乏适当隔离 的运行时上下文中被评估，理论上可以实现远程代码执行 RCE。 本仓库不提供 利用代码 它提供： 版本指纹识别 漏洞检...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

CVE-2026-95287

A flaw was found in Chromium. A missing authorization check in the navigation mechanism allows a remote attacker who has compromised a renderer process to bypass site isolation protections by convincing a user to load a crafted HTML page. Site isolation is a security boundary that separates web...

CVE-2026-95344

A flaw was found in chromium-browser. A race condition within the DevTools component allows a remote attacker to bypass site isolation security boundaries through social engineering. By tricking a user into installing a crafted browser extension, the attacker can exploit this timing flaw to acces...

CVE-2026-34926

⚠️ 安全研究与法律免责声明 📌 本仓库的目的 本仓库严格仅供教育、学术及授权的网络安全研究目的 使用。 其旨在支持理解以下内容： 在受控环境中的安全漏洞与利用概念 沙箱隔离机制及其局限性 安全软件设计与防御性安全实践 🚫 仅限授权使用 本仓库仅可在已获得明确许可的环境中使用，例如： 个人或受控虚拟机 Docker 或隔离实验室环境 授权的渗透测试任务 学术或网络安全培训设置 任何超出授权环境的使用均被严格禁止。 ⚖️ 不承担任何责任 本仓库的作者及贡献者不承担任何责任、义务或法律责任 ，对于因使用、误用或分发本项目或其内容而产生的任何滥用、损害、损失或法律后果概不负责。...

CVE-2026-95344

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Medium...

DEBIAN-CVE-2026-95344

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Medium...

DEBIAN-CVE-2026-95301

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-95301

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-95287

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95287

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102806

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereferenc...

CVE-2026-95287

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95344

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-95301

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

NPM: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

NPM: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors vulnerability discovered by ? in WordPress Npm undici versions = 8.10.0, 8.10.2...

CVE-2026-95344

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Medium...