Security notes, platform updates, and practical defensive guidance.
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid
Contributor PHP Object Injection in Nested Pages
Subscriber Broken Access Control in Optimole
Contributor PHP Object Injection in Photo Gallery by 10Web
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server...
Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (...
Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity...
Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security sev...