[SECURITY] Fedora 45 Update: lxappearance-obconf-0.2.4-5.fc45

This plugin adds an additional tab called "Window Border" to LXAppearance. It is only visible when the plugin is installed and Openbox is in use...

[SECURITY] Fedora 45 Update: compiz-0.8.18-22.fc45

Compiz is one of the first OpenGL-accelerated compositing window managers for the X Window System. The integration allows it to perform compositing effects in window management, such as a minimization effect and a cube work space. Compiz is an OpenGL compositing manager that use Compiz use...

EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

CVE-2026-54107

When ValidateHwnd Isn't a Gate: Root-Causing CVE-2026-54107 A use-after-free in win32kfull.sys window lifecycle management — how I found it, how I convinced myself it was real, and what the MSRC process actually looked like from the researcher's side. It was close to 2 AM when the target VM stopp...

CVE-2026-20805-PoC

🛡️ AI Security Tool Module CVE-2026-20805: Desktop Window Manager dwm.exe Memory Disclosure Official Security Audit Module for AI Security Tool Ecosystem 🌐 Web Demo • 📚 Project Website • 💬 Community Chat Website Navigation: Home • Updates • Downloads • Modules 🧠 Conceptual Overview This module...

CVE-2026-102674

A flaw was found in Electron. Windows opened from a sandboxed top-level document do not inherit that document's active sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document can open a popup window that runs with the application's full origin rather than...

CLEANSTART-2024-IW99789 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2024_1691)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241691 advisory. varnish: HTTP/2 Broken Window Attack may result in denial of service CVE-2024-30156 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_7435)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257435 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-283...

Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2024_1690)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241690 advisory. varnish: HTTP/2 Broken Window Attack may result in denial of service CVE-2024-30156 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-102110

A Kiteworks appliance is vulnerable to a missing authentication flaw in a setup function used during initial activation . An unauthenticated network attacker can repeatedly re-trigger the privileged activation process during this specific window because the endpoint fails to enforce intended stat...

Denial Of Service

Apache Qpid Proton-J is vulnerable to Denial of Service. The vulnerability is due to insufficient validation of the session flow control incoming window, where an authenticated attacker can exceed the incoming window size and potentially cause denial of service...

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

CVE-2026-102674

The Electron framework (prior to versions 41.10.6 , 42.9.2 , 43.4.1 , and 44.0.0-beta.5 ) contains a vulnerability where windows opened from a sandboxed top-level document fail to inherit the document's active HTML sandbox restrictions . This allows untrusted content in a sandboxed document to op...

CVE-2026-102674: Incorrect Privilege Assignment

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a...

GO-2026-6537 nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition

nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition...

CVE-2026-94285

A flaw was found in libX11. An out-of-bounds read vulnerability in the byte-oriented codeset parser allows a malicious X Window System server to cause a Denial of Service DoS by crashing connected client applications. This issue may also allow the server to access limited memory contents from the...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081

Multiple WordPress plugins—File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3)—are vulnerable to a DOM-based XSS due to improper validation of postMessage origins. The flaw exists in the bundled file-manager library (versions below 2.1.70), where the app...

Linux Distros Unpatched Vulnerability : CVE-2026-93799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: mvm: validate staid in BA window status notif BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to...