Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Low...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86594

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-87571

A flaw was found in Google Chrome. Improper certificate validation in the Loader component allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. This bypass could enable an attacker to circumvent security restrictions designed to isolat...

CVE-2026-87575

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the Loader component allows a remote attacker, through social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page, leading to unauthorized...

Malicious code in better-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf The package is a dotenv typosquat that runs a hidden Windows loader on every require and on CLI startup. dist/index.cjs and dist/cli.cjs invoke...

MAL-2026-17172 Malicious code in better-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf The package is a dotenv typosquat that runs a hidden Windows loader on every require and on CLI startup. dist/index.cjs and dist/cli.cjs invoke...

OESA-2026-4083 emacs security update

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a proje...

CVE-2026-93654: Improper Neutralization of Input During Web Page Generation

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-98393

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...

CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

SUSE CVE-2026-96545

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

DEBIAN-CVE-2026-88360

libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vipsavgscan subsequently...

CVE-2026-88360

libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vipsavgscan subsequently...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Loader component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper certificate validation in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policies through crafted network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Loader component in Google Chrome before version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

PT-2026-98201

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.12 ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Actions V1 allows an organization Action author with ORG OWNER, org.action.write, and org.flow.write permissions to read files from the host...