Chromium CVE-2026-87587: Use after free in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-78169

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

KLA91284 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution...

PT-2026-91957

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 140.16 Thunderbird versions prior to 140.16 Description A use-after-free issue exists within the Just-In-Time JIT component of the JavaScript Engine. A use-after-free is a memory corruption flaw that occurs when a...

EUVD-2026-78940

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...

CVE-2026-57138: Incomplete List of Disallowed Inputs

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-55692: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...

PT-2026-93222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Reflected Cross-Site Scripting issue exists where an attacker can craft a malicious link. If a legitimate user interacts with this link, it may cause the user...

CVE-2026-39038

BharatMLStack version v1.3.0 and below is vulnerable to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the trufflebox-ui component, specifically in the GenericNumerixTable.jsx file. Exploitation of this vulnerability could allow an attacker to execute malicious scripts in the ...

ROS-20260915-73-0127

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0131

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260915-73-0021

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260915-73-0125

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

CVE-2026-92021: Use After Free

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...

CVE-2026-81927: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-17495: Path Traversal: 'dir/../../filename'

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

PT-2026-93124

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description A stored cross-site scripting issue exists in SVG file handling. When the SVG processing is configured to the non-default mode concrete.file manager.images.svg sanitization.action = reject,...

ROS-20260915-73-0053

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260915-73-0031

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise data integrity...

CVE-2026-91922: Improper Neutralization of Input During Web Page Generation

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...