CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-66911 Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

CVE-2026-66911

Zimbra is vulnerable to a stored cross-site scripting (XSS) flaw involving the Content-Location MIME header in email attachments. The root cause is a lack of sanitization of this header, allowing an attacker to inject a javascript: URI. An unauthenticated remote attacker can send a crafted email;...

EUVD-2026-112941

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

pdfjs_disable_eval

pdfjsdisableeval Module for disabling JavaScript evaluation in PDF.js. This works around the missing fix in Odoo 14.0 for CVE-2024-4367...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

CVE-2026-111419

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

EUVD-2026-112695

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials...

CVE-2026-111419 Hardcoded API Token in Foxit Official Website

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials...

CVE-2026-111419 Hardcoded API Token in Foxit Official Website

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials...

CVE-2026-111419

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains hardcoded third-party authorization information . This exposure may allow unauthorized parties to obtain or misuse these credentials. The vulnerability is associated with CWE-798 (...