Total
864 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-62584 | 1 Navercorp | 1 Whale | 2026-10-08 | N/A | 7.5 HIGH |
| Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. | |||||
| CVE-2025-12905 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-07 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2025-14331 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-07 | N/A | 6.5 MEDIUM |
| Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. | |||||
| CVE-2025-69235 | 1 Navercorp | 1 Whale | 2026-10-07 | N/A | 7.5 HIGH |
| Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. | |||||
| CVE-2025-69259 | 2 Microsoft, Trendmicro | 2 Windows, Apex Central | 2026-10-07 | N/A | 7.5 HIGH |
| A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.. | |||||
| CVE-2025-69260 | 2 Microsoft, Trendmicro | 2 Windows, Apex Central | 2026-10-07 | N/A | 7.5 HIGH |
| A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability. | |||||
| CVE-2025-69258 | 2 Microsoft, Trendmicro | 2 Windows, Apex Central | 2026-10-07 | N/A | 9.8 CRITICAL |
| A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations. | |||||
| CVE-2025-66593 | 1 Synology | 1 Assistant | 2026-10-07 | N/A | 6.1 MEDIUM |
| An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2025-13593 | 1 Synology | 1 Activeprotect Agent | 2026-10-07 | N/A | 6.1 MEDIUM |
| Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2025-66592 | 1 Synology | 1 Active Backup For Business Agent | 2026-10-07 | N/A | 6.1 MEDIUM |
| An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2026-105783 | 2026-10-06 | N/A | 8.0 HIGH | ||
| Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13. | |||||
| CVE-2026-94243 | 1 Apache | 1 Sling Security | 2026-10-06 | N/A | 7.3 HIGH |
| A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue. | |||||
| CVE-2026-92068 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 5.4 MEDIUM |
| Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |||||
| CVE-2026-104056 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL. | |||||
| CVE-2026-92034 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.1 CRITICAL |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||||
| CVE-2026-100816 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.1 HIGH |
| Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-105396 | 2026-10-05 | N/A | 5.4 MEDIUM | ||
| Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials. | |||||
| CVE-2025-5263 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 4.3 MEDIUM |
| Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. | |||||
| CVE-2025-9180 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.1 HIGH |
| Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2. | |||||
| CVE-2025-23109 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 6.5 MEDIUM |
| Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134. | |||||