CVE-2026-100634: Missing Authorization

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

PT-2026-99661

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.57 Description An uninitialized resource in the GPU allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page...

openSUSE 16 Security Update : kbd (openSUSE-SU-2026:21939-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21939-1 advisory. This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that...

EUVD-2026-87213

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-80431

The kitty terminal (versions 0.40.0 to before 0.49.0 ) contains an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. The root cause is located in screen_handle_multicell_command() within kitty/screen.c, where the application appends codepoints to a fixed-s...

CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

CVE-2026-79109

A flaw was found in Google Chrome's printing component. A remote attacker, after compromising the renderer process, could exploit improper input validation by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

CVE-2026-87433

A flaw was found in Google Chrome. A race condition in the FileAPI component allows a remote attacker, who has already compromised the renderer process, to bypass site isolation. This bypass can be achieved by providing a specially crafted HTML page...

CVE-2026-79289

A flaw was found in Chromium. A remote attacker, after compromising the renderer process, could bypass site isolation by using a specially crafted HTML page. This could allow the attacker to access data or resources that should be isolated, potentially leading to further compromise of the user's...

CVE-2026-17795

A flaw was found in chromium-browser. An inappropriate implementation in the GetUserMedia component allows a remote attacker, who has compromised the renderer process, to leak sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML page...

Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

MAL-2026-17170 Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

Security update for kbd (important)

openSUSE security update: security update for kbd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21939-1 Rating: important References: bsc1275441 Cross-References: CVE-2026-72693 CVSS scores: CVE-2026-72693 SUSE : 7.8...

Erlang/OTP Type of Man-in-the-Middle

The vulnerability of the Erlang/OTP software platform is related to the choice of a less secure algorithm during the negotiation process. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” type attack...

CVE-2025-1218: Heap-based Buffer Overflow

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...