CVE-2026-79082

CVE-2026-79082 is an incorrect authorization flaw in the Transactions Platform component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this by serving a crafted HTML page to bypass the web origin polic...

CVE-2026-79082

Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-79082

Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-81670

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in the Transactions Platform allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The w...

PT-2026-81620

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description UI misrepresentation in the Transactions Platform allows a remote attacker to potentially spoof UI elements via a crafted HTML page by leveraging social engineering. Recommendations...

PT-2026-81677

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description A race condition in the Transactions Platform allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a use...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Binder: Fixed an issue where asyncfreespace accounting for empty parcels was incorrect. In version 4.13, commit 74310e06be4d “android:binder: Move buffer out of area shared with user space” fixed a issue related to the visibility...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

PT-2026-76589

Name of the Vulnerable Software and Affected Versions Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the...

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

CVE-2026-18709

CVE-2026-18709 concerns MongoDB Server: an authenticated user with direct network access to a shard can improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination. The underlying root cause is described as inadequate authorization around the pr...

CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

[SECURITY] Fedora 43 Update: valkey-8.1.9-1.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 44 Update: valkey-9.0.5-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

SUSE CVE-2026-64468

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderfreetransaction In binderfreetransaction, the t-toproc is read under the t-lock. However, once the t-lock is dropped, the toproc can die in parallel. This leads to a use-after-free error when we attempt t...

EUVD-2026-48812

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderfreetransaction In binderfreetransaction, the t-toproc is read under the t-lock. However, once the t-lock is dropped, the toproc can die in parallel. This leads to a use-after-free error when we attempt t...

SUSE CVE-2026-63858

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

CVE-2026-65058

The CVE-2026-65058 affects Trezor Safe firmware 3, 5, and 7, where a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow allows an attacker to present calldata and later supply a different tail, changing the signed transaction while only the initial calldata chunk is confirme...