858 matches found
EUVD-2026-27955
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-7926
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-7926
CVE-2026-7926 affects Google Chrome’s PresentationAPI prior to Chrome 148.0.7778.96. Description: use-after-free in PresentationAPI could allow a remote attacker to execute arbitrary code in the sandbox via a crafted HTML page. Connected sources indicate the fix is included in the Chrome 148 stab...
CVE-2026-7926
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-7926
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-7926
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-7926
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Insufficient Verification of Data Authenticity
Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the /auth/v1/introspectaccesstoken endpoint, which accepts any JWT signed by a key present on the node without validating the JWT type, issuer-to-key binding, or required claims. An...
nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token
Summary The v1 access token introspection endpoint /auth/v1/introspectaccesstoken accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation VP JWT to be replayed as an access token and...
GHSA-9HMG-827W-9RHJ nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token
Summary The v1 access token introspection endpoint /auth/v1/introspectaccesstoken accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation VP JWT to be replayed as an access token and...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a resource management vulnerability. This vulnerability stemmed from the reuse of the Presentation API after it was released, which could allow remote attackers to execute arbitrary...
PT-2026-37245
Name of the Vulnerable Software and Affected Versions nuts-node versions prior to 5.4.31 nuts-node versions prior to 6.2.3 Description The v1 access token introspection endpoint '/auth/v1/introspect access token' accepts any JSON Web Token JWT signed by a key present on the node without validatin...
PT-2026-38119
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description A use after free issue in the PresentationAPI allows a remote attacker to execute arbitrary code inside a sandbox by utilizing a crafted HTML page. Use after free is a memory corruption...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006667)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006667 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svcdeferredevent trace class Fix a NULL deref crash that occurs when an svcrqst i...
CVE-2026-5236
A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...
ROS-20260327-73-0002
Vulnerability in busybox related to information presentation errors in the user interface. Exploitation of the vulnerability could allow an attacker acting remotely to conduct spoofing attacks...
ROS-20260310-73-0014
A vulnerability in the Split View component of Google Chrome browser is related to information presentation errors in the user interface. Exploitation of the vulnerability could allow a remote attacker to conduct spoofing attacks...
Textream 访问控制错误漏洞
Textream is an audio/visual presentation application developed by Fatih Kadir Akın. Versions of Textream prior to 1.5.1 contained a security vulnerability related to access control. This vulnerability stemmed from the DirectorServer WebSocket server failing to validate the HTTP Origin header duri...
ROS-20260122-73-0018
A vulnerability in the Downloads component of the Google Chrome browser is related to user interface presentation errors. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions by using a specially crafted HTML page...
Malicious Package
Overview presentation-test-utilities is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...