SSR-DNSSEC

The DNS infrastructure used for this PoC was the one suggested on the SEED Labs, available at: https://seedsecuritylabs.org/Labs20.04/Networking/DNS/DNSSEC/, with some minor changes. The infrastructure, consists of a root server, a top-level domain server for edu, a domain server for example.edu,...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox 103...

ROS-20260911-73-0223

The vulnerability of the Subresource Integrity component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

The vulnerability of the Subresource Integrity component in Google Chrome and Microsoft Edge web browsers allows attackers to compromise data integrity.

The vulnerability of the Subresource Integrity component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

CVE-2026-59286

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286

Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.1.0–1.3.9, and 1.0.0–1.0.7) is affected by an unsafe dependency resolution issue in its bundled GraphiQL page, which loads JavaScript libraries from a public CDN without Subresource Integrity checks. An attacker who compromises the CDN or i...

CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

EUVD-2026-67175

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

PT-2026-82697

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 2.0.0 through 2.0.4 Spring for GraphQL versions 1.4.0 through 1.4.6 Spring for GraphQL versions 1.1.0 through 1.3.9 Spring for GraphQL versions 1.0.0 through 1.0.7 Description The GraphiQL page loads JavaScript...

CVE-2026-59286: Download of Code Without Integrity Check

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

PYSEC-2026-3653 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

CLSA-2026-1779238044 TuxCare security update for webpack-subresource-integrity (1 CVE)

TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.1-tuxcare.1...

CLSA-2026-1774225212 TuxCare security update for webpack-subresource-integrity (1 CVE)

TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.0-tuxcare.1...

PT-2026-74086

TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.0-tuxcare.1...

PT-2026-74811

TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.1-tuxcare.1...

EUVD-2026-49135

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

GO-2026-5450 KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt

KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt...