4 casos · pág. 1/1
CERT-FR advisory CERTFR-2026-AVI-1321, published 15 October 2026, reports multiple vulnerabilities in Drupal core that allow a remote attacker to execute arbitrary code and perform indirect code injection (XSS). The advisory references CVE-2026-108097, CVE-2026-108514 and CVE-2026-108515, based on three Drupal security bulletins dated 14 …
Hacktron researchers disclosed a one-click universal XSS (UXSS) in Perplexity Comet, a Chromium-based AI browser with the Comet Assistant agent extension. The extension's manifest trusts the wildcard https://.perplexity.ai/ in externallyconnectable, so a single XSS on any perplexity.ai subdomain can reach privileged extension message hand…
Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
