60
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
60
60
Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
78
60
60
Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws
60
60
60
60
60
60
Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record
60
60
60
60
60
60
Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit
60
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
60
60
60
60
60
MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.
63
60
60
60
60
60
60
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
60
60
60
60
60
60
60