ROS-20260911-73-0125

A vulnerability in the ANGLE component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied data. Exploitation of this vulnerability could allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

ROS-20260911-73-0139

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260911-73-0052

The vulnerability of the Spellcheck component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0163

The vulnerability of the TabStrip component in Google Chrome and Microsoft Edge relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260911-73-0060

The vulnerability of the Paint component in Google Chrome and Microsoft Edge is related to improper protection against attacks via external physical channels. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0091

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0190

The vulnerability of the Network component in Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information through a specially created HTML page...

ROS-20260911-73-0077

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability can allow a remote attacker to trigger a service failure through a specially created HTML page...

ROS-20260911-73-0126

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0118

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0166

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0030

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0079

The vulnerability of the Journeys web browsers Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0233

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

CVE-2026-68528: Improper Neutralization of Input During Web Page Generation

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

CVE-2026-89256: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

CVE-2026-89145: Improper Neutralization of Input During Web Page Generation

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

ROS-20260911-73-0045

The vulnerability of the Serial component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-89999

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...