EUVD-2026-53474

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-20289

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-20289

Cisco RoomOS contains a vulnerability in its logging subsystem where an authenticated, low-privilege local attacker can access sensitive information by enabling a specific logging level and collecting system logs. The issue arises from logging sensitive data, potentially exposing credentials. Rep...

keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-70605

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-70605 Electron: HTTP redirect followed into local file loader

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70605

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

EUVD-2026-53442

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70605 Electron: HTTP redirect followed into local file loader

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70605 Electron: HTTP redirect followed into local file loader

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70605

CVE-2026-70605 (Electron) concerns HTTP redirect handling via net.fetch() and net.request(). Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, redirects were not restricted to safe schemes, enabling a remote server to redirect to a local resource and potentially disclose local file contents if ...

Electron: HTTP redirect followed into local file loader

Impact When following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affecte...

Server-side Request Forgery (SSRF)

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the net.fetch or net.request. An attacker can access local file contents by redirectin...

NPM: Electron: HTTP redirect followed into local file loader

NPM: Electron: HTTP redirect followed into local file loader vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

GHSA-V64R-4M7R-3MVQ Electron: HTTP redirect followed into local file loader

Impact When following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affecte...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the parent process code-sign verification on macOS. An...

EUVD-2026-53403

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...