EUVD-2026-88367

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls...

CVE-2026-93463

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

domestic-system

The Domestic System A beautiful, terminal-based Ethereum wallet and smart contract browser built for sovereignty, security, and style. ━━━━━━━━━━━━━━━━━━━━ domestic system ━━━━━━━━━━━━━━━━━━━━ Overview The Domestic System is a terminal user interface TUI designed for browsing Ethereum EVM account...

LocalExifGeoMap

Local Exif Geo Map 📍 A powerful, privacy-focused, browser-based tool to visualize and analyze GPS data from your photos. Simply drag and drop images to generate interactive maps, heatmaps, elevation profiles, and trip statistics. Why? I've always wanted a self-hosted tool to analyze my photos and...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-89193

The Robin Image Optimizer WordPress plugin, in versions prior to 2.0.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin's bundled HTML parser fails to escape values re-emitted into element attributes when a non-default image delivery mode is enabled. This ...

CVE-2026-102331

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE Almost Native Graphics Engine component. An attacker could exploit this vulnerability by enticing a user to visit a...

PublicSafe

PublicSafe Your Browser, Your Safe Space PublicSafe is a free and open-source browser extension focused on privacy, encryption, and user control. It provides client-side encryption tools designed to help users protect sensitive information before it leaves their browser. PublicSafe is built aroun...

pki-toolbox

pki-toolbox A self-hosted, 100 % client-side toolbox for PKI artefacts : X.509 certificates, PKCS10 CSRs, chains, CRLs, PKCS7 and PKCS12 bundles, raw ASN.1, format conversion, fingerprints and certificate issuance. A privacy-respecting, self-hostable replacement for online certificate decoders...

EUVD-2026-89554

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

CVE-2026-103087

The Gosub browser engine (gosub-engine ) is vulnerable to uncontrolled recursion in versions through 0.1.0 and main before commit 46868b3 . An attacker can trigger a Denial of Service (stack exhaustion and application crash) by providing an SVG document with excessively nested elements. The engin...

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

EUVD-2026-89476

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

RHEL 8 : webkit2gtk3 (RHSA-2026:74084)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74084 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-71189

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-102325

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=561994362 https://code.google.com/p/chromium/issues/detail?id=102325...

CVE-2026-102326

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=560233248 https://code.google.com/p/chromium/issues/detail?id=102326...