CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...

CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...

RUSTSEC-2026-0312 Excluded iPAddress name constraints with an all-zero mask are not applied

An excludedsubtrees iPAddress name constraint with an all-zero mask 0.0.0.0/0 or ::/0 does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a /0 prefix matches every address of its family, so the exclusion was silentl...

Improper Input Validation

Apache ActiveMQ is vulnerable to improper input validation. The vulnerability is due to insufficient validation of the clientId when removing a durable topic subscription, which allows an authenticated attacker to spoof a client ID and potentially remove another client's durable topic subscriptio...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

Astra Linux – Vulnerability in Chromium

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Updater component of Google Chrome before version 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation through a malicious file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper input validation in the Network component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper certificate validation in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policies through crafted network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper state validation in the installer of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policies through crafted network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper certificate validation in FedCM using Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policies through crafted network traffic. Chromium security severity: Low...

CVE-2026-85682

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

EUVD-2026-85816

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...