CVE-2026-74956

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74956

A Same-origin policy bypass vulnerability exists in the DOM: Service Workers component. This issue affects Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific exploit information ...

PT-2026-76989

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A same-origin policy bypass exists within the DOM: Service Workers component. The same-origin...

CVE-2026-74956: Access of Resource Using Incompatible Type

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101486)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101486 advisory. Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101375)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101375 advisory. Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Tenable...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101152)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101152 advisory. Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

CVE-2026-18428 SQL Query Validation Bypass in OpenSearch Direct Query

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

PT-2026-71708

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

CVE-2026-18428: Protection Mechanism Failure

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

CVE-2026-73656: Authorization Bypass Through User-Controlled Key

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts,...

CVE-2026-19153 Insufficient validation of untrusted input in Workers

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-19153

A flaw was found in Google Chrome. Insufficient validation of untrusted input in the Workers component could allow a remote attacker, who has already compromised the renderer process, to bypass site isolation. This could enable the attacker to access sensitive information or further compromise th...

Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

MAL-2026-13777 Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

SummaryWith the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pag...

PT-2026-76470

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

Cloudflare Workers Environment Leak Detection

Scans wrangler.toml/json, .dev.vars, and Workers config paths for API tokens, account IDs, and secret vars embedded in client-accessible assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cloudflare Workers/Pages configuration and env leaks.""" from kittysploit import from...

Malicious code in sme-rko-finance-front-operations-tax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa On require, index.js loads platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts...