LavaDome

LavaDome 🌋️ 一个新的LavaMoat 工具，用于对 DOM 节点进行安全的 E ncapsulation（封装） ⚠️ 实验性 WIP - 使用风险自负（了解更多） 演示 试试LavaDome - 访问演示应用，打开控制台，尽你所能从 LavaDome 实例中窃取秘密（报告你的成功） 预览 （点击展开） 动机 在当今的 Web 标准下，还没有一种成熟的方法能够以安全的方式 选择性地隔离 DOM 子树。换句话说，如果各方共享同一个 JavaScript 执行环境，我们无法通过向某些方授予访问权限、同时阻止其他方访问，来控制对 DOM 各部分的访问。...

CVE-2026-85152

undici (the Node.js HTTP client) versions 8.10.0 through 8.10.2 are vulnerable to cross-origin cache poisoning when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The root cause is that the internal cache key falls back to an empty origin string, so a cacheable o...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...

GHSA-5V8V-XVJV-57X7 Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...

CVE-2026-26266

AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting XSS vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in ...

CVE-2025-58406

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls...

CVE-2025-58406

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls...

CVE-2025-58406

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls...

EUVD-2025-208152

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls...

CVE-2025-58406

Technical details about CVE-2025-58406 are not provided in the supplied documents. For CGM CLININET, specifics such as affected versions, root cause, and fixes are not disclosed here; monitor for updates.

MiracleLinux 7 : firefox-68.2.0-1.0.1.el7.AXS7 (AXSA:2019-4378:06)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4378:06 advisory. Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 CVE-2019-11764 Mozilla: Use-after-free when creating index updates in IndexedDB...

SUSE CVE-2018-5108

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20191106)

This update upgrades Thunderbird to version 68.2.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 CVE-2019-11764 - Mozilla: Use-after-free when creating index updates in IndexedDB CVE-2019-11757 - Mozilla: Potentially exploitable crash due to 360 Total...

Mozilla: document.domain-based origin isolation has same-origin-property violation

A flaw was found in Mozilla's firefox and thunderbird where if two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This could cause an interaction between two...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20191031)

Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 CVE-2019-11764 - Mozilla: Use-after-free when creating index updates in IndexedDB CVE-2019-11757 - Mozilla: Potentially exploitable crash due to 360 Total Security CVE-2019-11758 - Mozilla: Stack buffer overfl...

CentOS 7 : thunderbird (CESA-2019:3210)

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...