EUVD-2026-89470

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ipsubnet and fwip request parameters during th...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95375): chromium -- security fixes

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95366: Operation on a Resource after Expiration or Release

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Important: squid

Issue Overview: Due to a CWE-841 Improper Enforcement of Behavioral Workflow bug Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used. Bypassing security...

CVE-2026-94953

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field...

PT-2026-108422

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CVE-2026-71189: Improper Neutralization of Input During Web Page Generation

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

PT-2026-102920

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ip subnet and fw ip request parameters during...

CVE-2026-100243: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-4034: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-94952: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ipsubnet and fwip request parameters during th...

CVE-2026-94953: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field...

CVE-2026-100296: Improper Check for Unusual or Exceptional Conditions

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-95297: Missing Authorization

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95362: Cross-Site Request Forgery (CSRF)

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95352: Incorrect Authorization

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-95342: Missing Authorization

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95275: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102310: Missing Authorization

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95375: Incorrect Authorization

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...