CVE-2026-12869

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

EUVD-2026-44878

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

PT-2026-60570

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

PT-2026-60484

Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2 Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter...

ROS-20260716-73-0051

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260716-73-0019

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the use of memory after its execution. Exploiting this vulnerability could allow a remote attacker to cause a service failure by loading a specially created malicious extension...

ROS-20260716-73-0046

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine relates to the ability to utilize memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-67321

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Insufficient authorization checks on the SQL DEFINE FUNCTION statement when using LANGUAGE js allow users with database access to execute arbitrary JavaScript code. This bypasses security controls...

ROS-20260716-73-0029

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260716-73-0050

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260716-73-0071

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type conversion errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-60420

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any edit posts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

ROS-20260716-73-0040

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the JavaScript Engine component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

chromium -- security fixes

Chrome Releases reports: This update includes 7 security fixes: 516987782 Critical CVE-2026-15899: Use after free in CameraCapture. 523750584 Critical CVE-2026-15900: Use after free in GPU. 533446300 Critical CVE-2026-15901: Use after free in Network. 522436154 High CVE-2026-15902: Use after free...

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS vulnerability discovered by ? in WordPress Npm dd-trace versions 5.100.0...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in ui/src/app/applications/components/application-summary/application-summary.tsx, which splits an application link annotation on | into display text and href but renders the href without calling isValidURL, so...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...