EUVD-2026-68443

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...

OPENSUSE-SU-2026:21135-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 149.0.7827.155 boo1268373: CVE-2026-12437: Use after free in WebShare CVE-2026-12438: Inappropriate implementation in WebView CVE-2026-12439: Use after free in Digital Credentials CVE-2026-12440: Use after free i...

OPENSUSE-SU-2026:20849-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 148.0.7778.215 boo1266471: CVE-2026-9872: Out of bounds write in GPU CVE-2026-9873: Use after free in Network CVE-2026-9874: Use after free in Dawn CVE-2026-9875: Out of bounds read in WebGL CVE-2026-9876: Use...

OPENSUSE-SU-2026:20460-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 146.0.7680.177 boo1261249 CVE-2026-5273: Use after free in CSS CVE-2026-5272: Heap buffer overflow in GPU CVE-2026-5274: Integer overflow in Codecs CVE-2026-5275: Heap buffer overflow in ANGLE CVE-2026-5276:...

BIT-TOMCAT-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through...

OPENSUSE-SU-2026:20020-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 143.0.7499.192 boo1256067: CVE-2026-0628: Insufficient policy enforcement in WebView tag - Chromium 143.0.7499.169 stable released 2025-12-18 no cve listed yet Chromium 143.0.7499.146 boo1255115: CVE-2025-14765:...

BIT-TOMCAT-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1....

OPENSUSE-SU-2025:20032-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 141.0.7390.122: CVE-2025-12036: Inappropriate implementation in V8 boo1252402 Chromium 141.0.7390.107: CVE-2025-11756: Use after free in Safe Browsing boo1252013 Chromium 141.0.7390.76: Do not send URLs as AIM input. This is to resolve...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: litellm, open-webui...

ROOT-OS-DEBIAN-11-CVE-2026-55693 CVE-2026-55693 in vim - Patched by Root

Root has patched CVE-2026-55693 in the vim package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34982 CVE-2026-34982 in vim - Patched by Root

Root has patched CVE-2026-34982 in the vim package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-43961 CVE-2026-43961 in vim - Patched by Root

Root has patched CVE-2026-43961 in the vim package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

osmedeus v5.1.0

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

CVE-2026-82631

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexit...

CVE-2026-82838

Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...

EUVD-2026-68392

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

Laravel-Security

Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campbell/security-core. Feel free to check out the change log, releases, security policy, license, code of conduct, and contribution guidelines...