52749 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-77682
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JavaScript code injection in autofill via unsanitized CSS selector from element id fedora-all CVE-2026-77682 Note that Nessus relies on the presence of the...
Improper Verification of Source of a Communication Channel
Overview Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel through the localtrusted authentication middleware in server/src/middleware/auth.ts and the process adapter in server/src/adapters/process/execute.ts. An attacker can execute...
@agent-infra/browser-context (>=0.1.2, <=0.2.2), @agent-infra/mcp-server-browser (>=1.2.15, <=1.2.29) +111 more potentially affected by CVE-2026-61824 via defuddle (>=0.3.8, <=0.18.1)
defuddle NPM version =0.3.8, =0.1.2, =1.2.15, =0.1.0, =0.0.1777999615-g5ad1bf1, =0.8.0, =26.7.0, =0.3.1-alpha.1, =2.6.0, =1.0.2, =0.0.1, =0.8.4-main.43cb759274, =0.9.1-main.c7dcc2e112 and more Source cves: CVE-2026-61824 Source advisory: OSV:GHSA-JG4P-G6XJ-4QMF...
CVE-2026-69236
A stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 12.1 and prior allows a remote, privileged attacker to inject malicious code that can execute arbitrary JavaScript in a victim's browser. The CVSS 3.1 score is 6.1 (Medium) , reflecting network attack vector, low...
CVE-2026-69230 stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, an...
CVE-2026-15580
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...
EUVD-2026-63972
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...
CVE-2026-15580 PassPortal browser extension: vault token disclosure via unvalidated postMessage
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...
CVE-2026-15580
N-able PassPortal browser extension (Chrome and Edge) is vulnerable to vault token disclosure via an unvalidated postMessage handler. Any site or iframe presented to the user could gain complete, persisted access to the decrypted vault for up to 100 days, enabling authentication abuse. The issue ...
Chromium: CVE-2026-76040 Use after free in Browser
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-13789
An use after free flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=493847920...
CVE-2026-69233: Improper Neutralization of Input During Web Page Generation
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, an...
CVE-2026-15580: Missing Origin Validation in WebSockets
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...
[SECURITY] Fedora 43 Update: firefox-154.0-1.fc43
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 44 Update: firefox-154.0-3.fc44
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 44 Update: roundcubemail-1.7.3-1.fc44
RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...
BrowserBox v18.6.5
BrowserBox by DOSAYGO Secure, modern Remote Browser Isolation RBI with a clientless experience 🔐 NEW in v18.0.1 — Passkey authentication on macOS: sign in to websites with real passkeys inside your remote browser. Passkeys are created and stored on your Mac's Secure Enclave and unlocked with Touc...
SharpWeb v1.2
SharpWeb Introduction SharpWeb is a .NET 2.0 CLR compliant project that can retrieve saved logins from Google Chrome, Firefox, Internet Explorer and Microsoft Edge. In the future, this project will be expanded upon to retrieve Cookies and History items from these browsers. Usage root@kitploit:...
EUVD-2026-62932
In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...
