Lucene search
+L

129333 matches found

Github Security Blog
Github Security Blog
added 6 days ago9 views

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

5.9CVSS5.6AI score0.00157EPSS
SaveExploits0References2Affected Software1
Patchstack
Patchstack
added 6 days ago8 views

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

5.9CVSS5.5AI score0.00157EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 6 days ago9 views

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

5.9CVSS5.5AI score0.00157EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago47 views

CVE-2026-70606

Electron prior to versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0 has a vulnerability where a ProtocolResponse with a URL and no session could cause the upstream request to go through the defaultSession instead of the registering session. This could allow a cached response to be reused across otherw...

5.9CVSS5.5AI score0.00157EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago33 views

CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

5.9CVSS0.00157EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 6 days ago7 views

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...

7.4CVSS5.7AI score0.00206EPSS
SaveExploits0References2Affected Software1
Patchstack
Patchstack
added 6 days ago8 views

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

7.4CVSS5.4AI score0.00206EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 6 days ago48 views

CVE-2026-70604

In Electron, a vulnerability affects custom schemes registered with supportFetchAPI: true but without corsEnabled: true. Prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0, such schemes were not subject to CORS enforcement, allowing a page loaded from a remote origin to fetch() or XMLHttpReque...

7.4CVSS5.6AI score0.00206EPSS
SaveExploits0References1
OSV
OSV
added 6 days ago6 views

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

5.5AI score
SaveExploits0References1
NVD
NVD
added 6 days ago7 views

CVE-2026-16071

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

5.4CVSS0.00184EPSS
SaveExploits0References6
CVE
CVE
added 6 days ago41 views

CVE-2026-15572

CVE-2026-15572 (Keycloak) affects Keycloak’s Dynamic Client Registration (DCR) policy management. The bug is in the "Allowed Protocol Mapper Types" policy: during a client update, if the mapper’s configuration doesn’t change, re-validation of the mapper type is skipped, enabling an attacker with ...

8.8CVSS5.5AI score0.00347EPSS
SaveExploits0References6Affected Software1
EUVD
EUVD
added 6 days ago7 views

EUVD-2026-53398

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

8.8CVSS5.5AI score0.00347EPSS
SaveExploits0References6
Cvelist
Cvelist
added 6 days ago33 views

CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

8.8CVSS0.00347EPSS
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 6 days ago9 views

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

5.7AI score
SaveExploits0References2
Cvelist
Cvelist
added 6 days ago39 views

CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

0.00261EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 6 days ago7 views

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

9.1CVSS5.1AI score0.00143EPSS
SaveExploits0References3
SUSE Linux
SUSE Linux
added 6 days ago7 views

Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.6.7: CVE-2026-5299: ICMPv6 dissector crash bsc1263757. CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5402: TLS dissector crash and possible code execution bsc1263755. CVE-2026-5403: SBC audio codec crash bsc126376...

8.8CVSS7AI score0.0039EPSS
SaveExploits50References224
OSSF Malicious Packages
OSSF Malicious Packages
added 6 days ago7 views

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

5.5AI score
SaveExploits0References1
OSV
OSV
added 6 days ago6 views

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

8.5CVSS5.3AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 6 days ago2 views

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

8.6CVSS5.2AI score0.00118EPSS
SaveExploits0References3
Rows per page
Query Builder