CVE-2025-63307

CVE-2025-63307 – Cross-site Scripting XSS almacenado autenticado en laravel-file-manager v3.3.1 🧭 Resumen Una vulnerabilidad de Cross-site Scripting XSS almacenado autenticado en laravel-file-manager v3.3.1 y versiones anteriores permite a los atacantes con acceso a la interfaz del administrador ...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

cve-2026-80428-ctf

Laboratorio de entrenamiento CTF CVE-2026-80428 Emulador educativo de CVE-2026-80428 CWE-502: Deserialización de datos no confiables. Esto no es una instalación real de ILIAS y no es un paquete de exploit armado. Es un laboratorio completamente contenedorizado y aislado para estudiantes e...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

An observable discrepancy in the Network component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper handling of case sensitivity in the FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of after free in ANGLE in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of passwords in Google Chrome prior to version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in Skia in Google Chrome before version 152.0.7977.82 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

An observable discrepancy in Select in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information through a crafted HTML page. Chromium security severity: Low...

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151

The Post Grid WordPress plugin versions prior to 7.9.5 is vulnerable to HTML injection due to an improper limitation of the WordPress allowed-HTML list. Specifically, the plugin fails to restrict the expansion of this list to its own markup, applying it site-wide. This allows users with the Contr...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

Reachability-Check

Comprobación de Accesibilidad 🌐 ES | TR Comprobador de accesibilidad basado en navegador: pruebe la conectividad de red, las reglas del firewall y las restricciones de acceso. Archivo HTML único. Cero dependencias. No se requiere servidor web para ejecutarlo. Características Medición dual: HTTP...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...