Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-70606

Electron prior to versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0 has a vulnerability where a ProtocolResponse with a URL and no session could cause the upstream request to go through the defaultSession instead of the registering session. This could allow a cached response to be reused across otherw...

CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

CVE-2026-70604

In Electron, a vulnerability affects custom schemes registered with supportFetchAPI: true but without corsEnabled: true. Prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0, such schemes were not subject to CORS enforcement, allowing a page loaded from a remote origin to fetch() or XMLHttpReque...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

CVE-2026-16071

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

CVE-2026-15572

CVE-2026-15572 (Keycloak) affects Keycloak’s Dynamic Client Registration (DCR) policy management. The bug is in the "Allowed Protocol Mapper Types" policy: during a client update, if the mapper’s configuration doesn’t change, re-validation of the mapper type is skipped, enabling an attacker with ...

EUVD-2026-53398

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.6.7: CVE-2026-5299: ICMPv6 dissector crash bsc1263757. CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5402: TLS dissector crash and possible code execution bsc1263755. CVE-2026-5403: SBC audio codec crash bsc126376...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...