CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...

CVE-2026-87492

A flaw was found in DevTools in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to potentially execute arbitrary code outside the browser's security sandbox. The exploitation occurs when a user interacts with a specially crafted HTML page, leading to a severe...

CVE-2026-87474

A flaw was found in Google Chrome. A use-after-free vulnerability in the Payments component could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This exploitation is possible by enticing a user to visit a specially crafted HTML page...

CVE-2026-87464

A flaw was found in WebGL within Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation occurs when a user visits a specially crafted HTML page, leading to a critical security compromise...

CVE-2026-87455

A flaw was found in Aura in Google Chrome. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

CVE-2026-84354

A flaw was found in Google Chrome's FileSystem component. A remote attacker could exploit this vulnerability by leveraging social engineering techniques to trick a user into opening a specially crafted HTML page. This could lead to the execution of arbitrary code outside of the browser's security...

CVE-2026-83546

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

ROOT-APP-MAVEN-CVE-2025-66021 CVE-2025-66021 in com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer - Patched by Root

Root has patched CVE-2025-66021 in the com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer package for Root:Maven. Multiple fixed versions available...

EUVD-2026-75966

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript...

CVE-2026-85677

The Gutenverse News WordPress plugin (versions before 3.3.3 ) contains an unauthenticated stored XSS vulnerability. The root cause is that the plugin fails to restrict extra HTML it adds to WordPress's allowed elements to their specific intended contexts, applying a relaxed list to all sanitizati...

EUVD-2026-75957

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-18964

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...