7482 matches found
CVE-2026-16375
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component...
CVE-2026-16387
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...
CVE-2026-16358
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Graphics: WebRender component...
CVE-2026-63765 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...
SUSE-SU-2026:3221-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issue: - Firefox Extended Support Release 140.13.0 ESR MFSA 2026-70, bsc1271649: - CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component. - CVE-2026-15719: Site isolation issue in the DOM: Navigation component. - CVE-2026-16349...
CVE-2026-47755
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...
CVE-2026-65917
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917
CyberPanel
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65902
DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
SummaryIn affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Persistent Cache of Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Accessibility feature of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the WebUI of Google Chrome on Linux, Mac, Windows, and ChromeOS prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Loader component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...