The Stable channel has been updated to 146.0.7680.75/76 for Windows/Mac and 146.0.7680.75 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Security Fixes and Rewards
Updated 2026-03-13: The previous version of these notes included CVE-2026-3909, the fix
for which will instead be available in a future update.
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 1 security fix. Please see the Chrome Security Page for more information.Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
BookStack v25.12.9 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.
As of February 2026, the PostgreSQL Community Association (PGCA), the official non-profit organization chartered by the PostgreSQL Core Team in 2011 to protect the Postgres brand assets, has updated its sponsorship levels and sponsorship prospectus.
The PGCA Board would not be able to protect the PostgreSQL trademarks and brand assets without the generous financial support we receive from corporations, small businesses, and individual donors. We are deeply grateful for that support.
After reviewing sponsorship models used by other open source foundations, and in light of the increasing costs required to protect the PostgreSQL brand assets, we have increased the top two sponsorship levels: Benefactor and Patron, effective February 1, 2026. All other sponsorship levels remain unchanged. As always, we welcome and value donations at all levels, in any amount.
We’ve also made a significant update to the PGCA website, to modernize it and bring it forward to the present. We hope the new site makes it easier to understand the PGCA’s non-profit mission, learn how to use PostgreSQL trademarks appropriately, and donate, whether as a one-time or monthly contribution.
The updated PGCA website is at the same URL as before: www.postgres.ca.
Updated sponsorship levels and the sponsorship prospectus can be found on the Sponsors page at www.postgres.ca/sponsors/.
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about
[A hyperlinked version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.1.html]
Postfix stable release 3.11.1 is available.
Bugfix (defect introduced: 20260219): alias_maps errors when default_database_type was not set in main.cf. Fix by Michael Tokarev.
Bugfix (defect introduced: Postfix 3.0): buffer over-read when Postfix is configured with an enhanced status code not followed by other text. For example, "5.7.2" without text after the three-number code, in an access(5) table, header or body checks, or with "$rbl_code $rbl_text" in rbl_reply_maps or default_rbl_reply. These are all uncommon configurations. Problem reported by Kamil Frankowicz.
Bugfix (defect introduced: Postfix 3.3): null pointer in nbdb_reindexd(8) because the "service_name" value was not propagated. Report by Michael Tokarev.
During Postfix start-up, avoid a spurious error message from nbdb_reindexd(8), when non_bdb_migration_level disables automatic re-indexing.
You can find the Postfix source code at the mirrors listed at https://www.postfix.org/.
Log inOPENAPI_ENABLED (#26868 by @br41nslug)OPENAPI_ENABLED (#26868 by @br41nslug)@directus/app@15.5.1@directus/api@34.0.1@directus/ai@1.3.0@directus/composables@11.2.15create-directus-extension@11.0.31@directus/env@5.6.1@directus/extensions@3.0.21@directus/extensions-registry@3.0.21@directus/extensions-sdk@17.0.11@directus/memory@3.1.4@directus/pressure@3.0.19@directus/schema-builder@0.0.16@directus/storage-driver-azure@12.0.19@directus/storage-driver-cloudinary@12.0.19@directus/storage-driver-gcs@12.0.19@directus/storage-driver-s3@12.1.5@directus/storage-driver-supabase@3.0.19@directus/system-data@4.3.0@directus/themes@1.2.6@directus/types@14.3.1@directus/utils@13.3.1@directus/validation@2.0.19
The Chrome team is delighted to announce the promotion of Chrome 146 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 29 security fixes. Please see the Chrome Security Page for more information.
[$33000][483445078] Critical CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-10
[$43000][481776048] High CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga on 2026-02-04
[$43000][483971526] High CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-12
[$36000][482828615] High CVE-2026-3916: Out of bounds read in Web Speech. Reported by Grischa Hauser on 2026-02-09
[$11000][483569512] High CVE-2026-3917: Use after free in Agents. Reported by Syn4pse on 2026-02-11
[$10000][483853103] High CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse on 2026-02-12
[$2000][444176961] High CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-09-10
[TBD][482875307] High CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google on 2026-02-09
[TBD][484946544] High CVE-2026-3921: Use after free in TextEncoding. Reported by Pranamya Keshkamat & Cantina.xyz on 2026-02-17
[TBD][485397139] High CVE-2026-3922: Use after free in MediaStream. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18
[TBD][485935314] High CVE-2026-3923: Use after free in WebMIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-20
[TBD][487338366] High CVE-2026-3924: Use after free in WindowDialog. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-25
[$10000][418214610] Medium CVE-2026-3925: Incorrect security UI in LookalikeChecks. Reported by NDevTK and Alesandro Ortiz on 2025-05-17
[$7000][478659010] Medium CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c on 2026-01-26
[$3000][474948986] Medium CVE-2026-3927: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-11
[$2000][435980394] Medium CVE-2026-3928: Insufficient policy enforcement in Extensions. Reported by portsniffer443 on 2025-08-03
[$2000][477180001] Medium CVE-2026-3929: Side-channel information leakage in ResourceTiming. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-20
[$1000][476898368] Medium CVE-2026-3930: Unsafe navigation in Navigation. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-19
[TBD][417599694] Medium CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-05-14
[TBD][478296121] Medium CVE-2026-3932: Insufficient policy enforcement in PDF. Reported by Ayato Shitomi on 2026-01-23
[TBD][478783560] Medium CVE-2026-3934: Insufficient policy enforcement in ChromeDriver. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-26
[TBD][479326680] Medium CVE-2026-3935: Incorrect security UI in WebAppInstalls. Reported by Barath Stalin K on 2026-01-28
[TBD][481920229] Medium CVE-2026-3936: Use after free in WebView. Reported by Am4deu$ on 2026-02-05
[$3000][473118648] Low CVE-2026-3937: Incorrect security UI in Downloads. Reported by Abhishek Kumar on 2026-01-03
[$2000][474763968] Low CVE-2026-3938: Insufficient policy enforcement in Clipboard. Reported by vicevirus on 2026-01-10
[$1000][40058077] Low CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK on 2021-11-30
[$1000][470574526] Low CVE-2026-3940: Insufficient policy enforcement in DevTools. Reported by Jorian Woltjer, Mian, bug_blitzer on 2025-12-21
[$1000][474670215] Low CVE-2026-3941: Insufficient policy enforcement in DevTools. Reported by Lyra Rebane (rebane2001) on 2026-01-10
[N/A][475238879] Low CVE-2026-3942: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-12
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
nginx-1.29.6 mainline version has been released, featuring sticky sessions support for upstreams.
