Xerox Printers Clone File OS Command Injection (CVE-2021-28673)

Xerox Phaser 6510 before 64.61.23 and 64.59.11 Bridge, WorkCentre 6515 before 65.61.23 and 65.59.11 Bridge, VersaLink B400 before 37.61.23 and 37.59.01 Bridge, B405 before 38.61.23 and 38.59.01 Bridge, B600/B610 before 32.61.23 and 32.59.01 Bridge, B605/B615 before 33.61.23 and 33.59.01 Bridge,...

Xerox Printers Remote Command Execution (CVE-2021-28671)

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

About the security content of Safari 26.6

About the security content of Safari 26.6 This document describes the security content of Safari 26.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

CVE-2024-14040

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall...

Information Disclosure

Open WebUI is vulnerable to sensitive Information Exposure. The vulnerability is due to insufficient authorization on the channel members API, where full user settings are returned to channel participants, allowing authenticated users to access sensitive information such as tool server keys and...

Fedora 43 : chromium (2026-acf674bc6a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-acf674bc6a advisory. Update to 150.0.7871.181 CVE-2026-16413: Out of bounds write in ANGLE CVE-2026-16414: Insufficient validation of untrusted input in Chromecast...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21438-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21438-1 advisory. Changes in chromium: - Chromium 150.0.7871.181 boo1272156: CVE-2026-16420: Type Confusion in WebAudio CVE-2026-16421: Inappropriate implementati...

EUVD-2026-42621

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config...

MGASA-2026-0293 Updated transmission packages fix a security vulnerability

The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. CVE-2026-38978...

Updated transmission packages fix a security vulnerability

The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. CVE-2026-38978...

Chromium: CVE-2026-16423 Use after free in UI

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

OPENSUSE-SU-2026:21438-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 150.0.7871.181 boo1272156: CVE-2026-16420: Type Confusion in WebAudio CVE-2026-16421: Inappropriate implementation in WebAudio CVE-2026-16413: Out of bounds write in ANGLE CVE-2026-16414: Insufficient validation ...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

GHSA-XVCM-6775-5M9R vulnerabilities

Vulnerabilities for packages: vitess, nextcloud-server, rancher-api-ui, argo-workflows...

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands SummaryPraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a comma...

EUVD-2026-48240

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

CVE-2026-64815

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Guest View component of Google Chrome prior to version 149.0.7827.103 allowed a remote attacker to perform UI spoofing through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...