DEBIAN-CVE-2026-5895

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted domain name. Chromium security severity: Low...

CVE-2026-5897

Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5882

Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5878

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5896

The issue CVE-2026-5896 concerns a policy bypass in Audio in Google Chrome (Chromium) prior to 147.0.7727.55, where a crafted HTML page could lure a user into specific UI gestures to bypass sandbox download restrictions. Connected documents show Chromium/Chrome updates addressing this, with Chrom...

EUVD-2026-20513

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to rea...

CVE-2026-32591

The CVE-2026-32591 issue affects Red Hat Quay’s Proxy Cache feature. When an organization administrator configures an upstream registry for proxy caching, Quay opens a network connection to the specified registry hostname without validating that it points to a legitimate external service. An atta...

CVE-2025-57853 Web-terminal: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root...

CVE-2026-5600

CVE-2026-5600 involves a new API endpoint in pretix (2025 release) that should return check-in events for a specific event but instead exposes all check-in events under the organizer. The affected component is the API handling check-in data; the root cause is an endpoint mis-scoping that leaks re...

EUVD-2026-20259

Cross-Site Request Forgery CSRF vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through = 7.1...

CVE-2026-39585 WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16...

CVE-2026-34781

creationtimestamp| type| source ---|---|--- 2026-04-08 00:19:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwzhg2zt42i...

PT-2026-31448

Name of the Vulnerable Software and Affected Versions D-Link DIR-645 versions 1.01 through 1.03 Description A stack-based buffer overflow exists in the hedwigcgi main function of the /cgi-bin/hedwig.cgi file. This issue can be exploited remotely. The exploit is publicly available. Recommendations...

PT-2026-31341

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in Red Hat Quay's container image upload process. An authenticated user with push access to any repository can interfere with image uploads in progress by other users, even...

saleor 安全漏洞

Saleor is an open-source interface software developed by Saleor Commerce. Vulnerabilities exist in versions of Saleor from 2.0.0 to 3.23.0a3, as well as versions before 3.22.47, 3.21.54, and 3.20.118. These vulnerabilities stem from the possibility for malicious actors to include multiple GraphQL...

PT-2026-31219

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through = 4.8.2...

PT-2026-31447

A security flaw has been discovered in bigsk1 openai-realtime-ui up to 188ccde27fdf3d8fab8da81f3893468f53b2797c. The affected element is an unknown function of the file server.js of the component API Proxy Endpoint. Performing a manipulation of the argument Query results in server-side request...

PT-2026-31094

Name of the Vulnerable Software and Affected Versions WP Blockade plugin for WordPress versions up to and including 0.9.14 Description The WP Blockade plugin for WordPress is susceptible to a missing authorization issue. The plugin registers an admin post action hook 'wp-blockade-shortcode-render...

pretix 安全漏洞

Pretix is a ticketing system developed by the German company Pretix. The pretix 2025 version contains a security vulnerability. This vulnerability stems from the API endpoint returning information about all organizers’ sign-in events. As a result, API users may access event information that shoul...

CVE-2026-5686

A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released...