CVE-2026-73426

A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...

CVE-2026-75357

Bilibili Desktop v.1.17.9 contains a vulnerability in the bili-inject.js and bili-bridge.js components that allows a remote attacker to execute arbitrary code without requiring authentication or user interaction. The vulnerability is rated CVSS 9.8 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/...

CVE-2026-75357

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

CVE-2026-16809

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

CVE-2026-16809

CVE-2026-16809 affects LimeSurvey Community Edition 7.0.5 and is a stored cross-site scripting (XSS) vulnerability in the survey quota creation workflow. An authenticated low-privileged user with the ability to create and manage their own survey can store malicious JavaScript in a quota message ,...

CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

MAL-2026-14545 Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...

CVE-2026-79236

A flaw was found in Chromium. This type confusion vulnerability in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within the sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page...

GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

Malicious code in mobiwaefhxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

CVE-2026-78938

A flaw was found in the V8 JavaScript engine used in Chromium-based browsers. This type confusion vulnerability allows a remote attacker to execute unauthorized code within the browser's security sandbox by tricking a user into visiting a specially crafted web page. This could lead to a compromis...

CVE-2026-78901

A flaw was found in the V8 JavaScript engine. A race condition vulnerability allows a remote attacker to execute arbitrary code within the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-76020

A race condition flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=541837151...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

CVE-2026-73335

Myna Point (an Android application, package jp.go.soumu.mkpf.mkpfmypage) is vulnerable to Improper Authorization (CWE-939) in its handler for a custom URL scheme . A malicious application already installed on the same device can send an Intent to the affected app, potentially causing arbitrary Ja...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

PT-2026-82210

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4 Description A DOM-based Cross-Site Scripting XSS issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...