Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
New Browser Attack Allows Tracking Users Online With JavaScript Disabled
Researchers have discovered a new side-channel that they say can be reliably exploited to leak information from web browsers that could then be leveraged to tr…
Home Routers: Remote Attacks Through Malicious JavaScript Exploit
They have demonstrated that users could open up their router's traffic as a result of visiting a web page loaded with malicious javascript. The researchers sai…
openSUSE 2026-3396-1 webkit2gtk3 Important JavaScript Execution Risk
A security update for webkit2gtk3 addresses 23 vulnerabilities, including issues that could lead to arbitrary JavaScript execution, unexpected crashes, and dat…
Fedora 43 os-autoinst Update CVE-2025-13465 JavaScript Fix
This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and enhancements. Please see upstream changelogs for details. They al…
Ubuntu 5494-1: SpiderMonkey JavaScript Library vulnerabilities
Several security issues were fixed in SpiderMonkey JavaScript Library.
New JavaScript-based SMASH Attack Confirms Rowhammer Bug As A Persistent Threat
While Rowhammer attacks are nothing new, another exploitation of the bug has arrived. Dubbed SMASH,…New JavaScript-based SMASH Attack Confirms Rowhammer Bug As…
Debian webkit2gtk Critical JavaScript Exec Risk DSA-6398-1
Multiple vulnerabilities in WebKitGTK have been identified, leading to process crashes, memory corruption, and potential data leaks; users are urged to upgrade…
Fedora 43 perl-JavaScript-Minifier-XS Updates Fix Critical CVEs 56017 56018
0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018
Fedora 44 perl-JavaScript-Minifier-XS Critical CVE Fixes 2026-634b594205
0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018
SUSE: MozillaFirefox Important JavaScript Execution Issues 2025:02531-1
* bsc#1246664 Cross-References: * CVE-2025-8027 * CVE-2025-8028
SUSE: 2025:02153-1 moderate: yelp-xsl JavaScript file read
* bsc#1240688 Cross-References: * CVE-2025-3155
openSUSE Leap: 2025:01904-1 moderate: yelp JavaScript threat
* bsc#1240688 Cross-References: * CVE-2025-3155
Tails 5.1 Arrives with a Fix for a Serious JavaScript Security Vulnerability
The Tails project has announced the release of Tails 5.1. It comes with improvements to the Tor Connection assistant, the Unsafe Browser and captive portals, a…
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and …
Debian LTS: DLA-3886-1: nodejs Security Advisory Updates
Node.js a JavaScript runtime environment that executes JavaScript code outside a web browser (server side) was vulnerable. CVE-2023-30589
Mageia 2021-0554: thunderbird security upda
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level…
Mageia 2020-0383: phpmyadmin security upda
A vulnerability was discovered where an attacker can cause an XSS attack through the transformation feature. If an attacker sends a crafted link to the victim …
Command Injection Flaw in shell-quote Can Execute Linux Commands
The maintainers of shell-quote, a JavaScript library for building shell commands, released version 1.11.0 on September 29, 2026, to fix CVE-2026-102422.
SUSE MozillaFirefox Important Security Update 2026-3658-1
SUSE has released a security update for MozillaFirefox addressing 58 vulnerabilities, including critical issues in components like Graphics and JavaScript, wit…
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published.The vulnerabilities are listed b…
Debian LTS Beets Remote Code Exec Vulnerability DLA-4641-1
It was discovered that beets, a media library management system, is vulnerable to run arbitrary JavaScript code in the victim browser, exfiltrate viewable data…
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution.Steer t…
Actively Exploited Chromium V8 Zero-Day: What Linux Admins Need to Know
CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog after Google confirmed active exploitation of the flaw. The bug sits in V8, the JavaSc…
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Cybersecurity researchers have flagged half a dozen vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers (Protobuf), …