Lucene search
+L

9115 matches found

OSV
OSV
added 2026/07/08 12:6 p.m.11 views

RLSA-2026:35842 Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

8.1CVSS6.6AI score0.03711EPSS
SaveExploits1References14
NVD
NVD
added 2026/07/08 1:16 a.m.13 views

CVE-2026-55438

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...

6.8CVSS0.0015EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/08 12:31 a.m.12 views

EUVD-2026-42151

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...

6.8CVSS6AI score0.0015EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/07/08 12:31 a.m.45 views

CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...

5.8CVSS0.0015EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/08 12:0 a.m.19 views

PT-2026-56643

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.115 Description Insufficient policy enforcement in the Passwords component allows a remote attacker to bypass the same origin policy, which is a security mechanism that restricts how a document or...

8.8CVSS6AI score0.00326EPSS
SaveExploits0References36
ATTACKERKB
ATTACKERKB
added 2026/07/07 8:48 p.m.10 views

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

3.9CVSS6AI score0.00255EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/07/07 8:48 p.m.17 views

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

3.9CVSS6AI score
SaveExploits0References5
OSV
OSV
added 2026/07/07 2:34 p.m.9 views

PYSEC-2026-1720 Open WebUI Vulnerable to a Session Fixation Attack

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

7.6CVSS7.7AI score0.00675EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/07 2:34 p.m.9 views

PYSEC-2026-1946 Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

3.7CVSS6AI score0.00375EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 1:1 p.m.9 views

GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding

Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...

5.3CVSS5.9AI score0.00159EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/07 1:1 p.m.9 views

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GET /api/oauth/email/bind and GET /api/oauth/wechat/bind endpoints. An attacker can alter account binding state by tricking a logged-in user into visiting a crafted link, potentially allowing the...

6CVSS5.9AI score0.00159EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/07 10:16 a.m.19 views

CVE-2026-49296

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

6.5CVSS0.00384EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/07/07 6:46 a.m.9 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:39 a.m.14 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:33 a.m.11 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/07 6:33 a.m.9 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS5.9AI score0.00189EPSS
SaveExploits0References6
SUSE CVE
SUSE CVE
added 2026/07/07 2:37 a.m.13 views

SUSE CVE-2026-13822

Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. Chromium security severity: High...

6.5CVSS6AI score0.00164EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:37 a.m.15 views

SUSE CVE-2026-13838

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

6.5CVSS6AI score0.00224EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:36 a.m.13 views

SUSE CVE-2026-13881

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00211EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/07 2:35 a.m.12 views

SUSE CVE-2026-13921

Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

6.5CVSS6AI score0.00328EPSS
SaveExploits0References3
Rows per page
Query Builder