CVE-2026-56128

A flaw was found in pfSense Plus and CE. An authenticated user with the 'Firewall: Schedules: Edit' privilege can inject malicious JavaScript code into the schedule description. This code is stored without proper sanitization and executes in the browser of any user with the 'Firewall: Rules'...

CVE-2026-85541

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

EUVD-2026-70989

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

EUVD-2026-70983

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541

DreamMaker developed by Interinfo contains a Reflected Cross-site Scripting (XSS) vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a victim's browser via a malicious website. The CVSS 3.1 base score is 5.4 (MEDIUM) with a changed scope, requiring low privileges an...

GHSA-C76R-4QFW-4W98 vulnerabilities

Vulnerabilities for packages: chromium...

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...

EUVD-2026-71609

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-76178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with...

EUVD-2022-56034

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 is affected by a Multiple Stored XSS vulnerability in two web GUI pages: backup_restore.jsp (under NP_IBCF-NATUP-01) and storage.jsp (under NP_IBCF-MIBER-03), via the name parameter . A malicious authenticated user can inject arbitrary JavaScript that executes wh...

CVE-2026-75170

This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

PT-2026-85780

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget versions 26.03, 25.11.1, CE 2.8.1. Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: https://t.co/XaOt7Xazw4 cybersecurit valtersit CVE CVEAlert infosec...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

Prototype Pollution

Overview org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggerin...

EUVD-2026-42050

Phoenix: Presence keys colliding with Object.prototype members break existence checks...

CVE-2026-85046

A flaw was found in V8, the JavaScript engine in Google Chrome. This type confusion vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a compromise of the user's system...