PT-2026-68703

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description A use after free issue exists in Views on Windows. A remote attacker can exploit heap corruption—a condition where memory is corrupted in the heap area—by convincing a user to perform...

Google Chrome < 151.0.7922.108 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 151.0.7922.108. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop01193673229 advisory. - Use after free in Skia. CVE-2026-19154, CVE-2026-19176 - Use aft...

CVE-2026-19172: Use After Free

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

Google Chrome < 151.0.7922.108 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 151.0.7922.108. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop01193673229 advisory. - Use after free in Skia. CVE-2026-19154, CVE-2026-19176 - Use after...

WordPress Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Views versions = 3.9.1...

Views Component DoS

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

MAL-2026-11737 Malicious code in @or-sdk/views (npm)

npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

GHSA-P4R4-8CXW-PJX7 Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rj9j-8772-4h6c. This link is maintained to preserve external references. Original Description Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the...

Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rj9j-8772-4h6c. This link is maintained to preserve external references. Original Description Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-17580

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-17580 Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-17580 Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-17580

The CVE concerns the WordPress plugin Advanced Views (Display Custom Fields) versions up to and including 3.9.1. It exposes sensitive content via REST endpoints register_rest_routes (view-refresh and card-refresh), where an authenticated user with subscriber-level access or higher can access admi...

CVE-2026-17580

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

Microsoft Edge (Chromium) < 151.0.4129.59 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.59. It is, therefore, affected by multiple vulnerabilities as referenced in the July 31, 2026 advisory. - Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute...

PT-2026-67125

Name of the Vulnerable Software and Affected Versions Advanced Views versions prior to 3.9.2 Description The plugin is susceptible to sensitive information exposure through the register rest routes function. Authenticated users with subscriber-level access or higher can extract admin-authored...

CVE-2026-17580: Missing Authorization

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...