BrowserBox v19.0.3

BrowserBox — Remote Browser Isolation A full remote browser. Clientless access. Native performance. Self-host on Windows, macOS or Linux, or create cloud browser sessions through the API. Start a 7-Day Paid Evaluation · Buy a Commercial License · Talk to Sales Website · Live Demo · Documentation ...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled query input being reflected into raw HTML without proper output encoding, which allows an unauthenticated attacker to inject malicious scripts through a crafted query and execute them in ...

exploit-framework

Exploit Framework Browser-based Exploit Research Framew...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:FacetedSearch process. An attacker can inject arbitrary HTML or JavaScript into the response by crafting a request with malicious cstate parameters that are not properly escaped, leading to...

CVE-2025-1350

IBM Controller (also known as IBM Cognos Controller) versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 are affected by a sensitive information disclosure vulnerability (CWE-209). A remote, unauthenticated attacker can obtain sensitive information when a detailed technical error mes...

CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

EUVD-2026-82426

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

Security Bulletin: IBM QRadar SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-45819)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before...

CVE-2026-91749

An use after free flaw was found in the Workers component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=558456602...

PT-2026-95084

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 2.0.0 through 2.1.0 Description Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view...

KLA91293 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Network can be...

PT-2026-95119

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by Google Chrome. This flaw allows a remote attacker to execute arbitrary...

privacybadger v2026.9.15

Privacy Badger Privacy Badger is a browser extension that automatically learns to block hidden trackers. Privacy Badger is made by the leading digital rights nonprofit EFF to stop companies from spying on you. Privacy Badger sends the Global Privacy Control signal to opt you out of data sharing a...

CVE-2026-92784

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784

@refinedev/inferencer through version 7.0.0 (part of the refine framework) is vulnerable to code injection via API field names . The root cause is a failure to escape API field names when interpolating them into generated JSX source code . An attacker controlling the data provider can inject mali...

CVE-2026-92781

Builder.io Gen2 SDKs (through versions 5.2.11 and 0.25.13 ) are affected by a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. An attacker can craft preview links containing __proto__ or prototype segments t...