Autor: Peter Leibling

Chromium: CVE-2026-3939 Use after free in WebView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

Chromium: CVE-2026-3938 Insufficient policy enforcement in Clipboard

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

Chromium: CVE-2026-3937 Incorrect security UI in Downloads

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

Chromium: CVE-2026-3936 Use after free in WebView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

Chromium: CVE-2026-3941 Insufficient policy enforcement in DevTools

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

CVE-2026-21256 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Changes made to the security updates links and information. This is an informational change only.

CVE-2026-21257 GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability

Changes made to the security updates links and information. This is an informational change only.

[NEU] [hoch] Linux Kernel / AppArmor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im AppArmor ausnutzen, um Root-Rechte zu erlangen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Schutzmechanismen für kritische Dienste zu manipulieren und so weitere Fernangriffsketten sowie eine vollständige Kompromittierung des Systems zu ermöglichen.

Sicherheitslücke in „Ally“ WordPress Plugin gefährdet 400.000 Websites

Angreifer können über eine Schwachstelle im WordPress-Plugin „Ally“ eigene Befehle ausführen. Admins sollten den Sicherheitspatch installieren.

Veeam Backup & Replication: Kritische Schadcode-Sicherheitslücken entdeckt

In Veeam Backup & Replication schließt das Unternehmen mit Updates mehrere kritische Sicherheitslücken. Sie erlauben Codeschmuggel.