ROS-20260915-73-0027

The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260915-73-0124

The vulnerability of the Ozone component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0026

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0090

The vulnerability of the Cast component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260915-73-0146

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

ROS-20260915-73-0126

The vulnerability of the WebAuthentication component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0094

The vulnerability of the Content Security Policy component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability allows an attacker to compromise data integrity through a specially crafted HTML page...

CVE-2026-85892

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Edge Chromium-based allows an authorized attacker to elevate privileges locally...

EUVD-2026-77693

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Edge Chromium-based allows an authorized attacker to elevate privileges locally...

CVE-2026-85892

CVE-2026-85892 is a race condition vulnerability in Microsoft Edge (Chromium-based) , caused by concurrent execution using a shared resource with improper synchronization. An authorized attacker can exploit this to elevate privileges locally , with the scope changed to allow full compromise of co...

memory-poisoning-axis

memory-poisoning-axis Deterministic memory-poisoning / prompt-injection measurement — anchored to CVE-2026-24301 "CoSnitch" Microsoft Copilot Personal, CVSS 3.1 8.8, patched 18 Aug 2026. CoSnitch chained: i automatic prompt execution ?q= + undocumented ?autorun=1, ii data exfiltration via...

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fixed potential crashes during module unloading. The vmbus driver relies on the panic notifier infrastructure to perform certain operations when a panic event is detected. Since vmbus can be built as a module,...

CVE-2026-10556

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow's is a new record: Microsoft's patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. This allows an unauthenticated attacker to send a crafted POST request to the public webhook endpoint, crashing the Microso...

EUVD-2026-77379

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...