EUVD-2026-47568

Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2026-47573

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

ROS-20260722-73-0012

The vulnerability of the Cast component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially created HTML page...

ROS-20260722-73-0016

The vulnerability of the Preload function in Google Chrome and Microsoft Edge is related to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML pag...

ROS-20260722-73-0014

The vulnerability of the Cast component in Google Chrome and Microsoft Edge relates to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security restrictions through a specially created HTML page...

PT-2026-63355

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

PT-2026-63506

Name of the Vulnerable Software and Affected Versions Regular Labs extensions affected versions not specified Description Cross-site scripting XSS is possible through tag-provided custom HTML, module content or title overrides, and decoded modal or tooltip values. This allows a content author to...

MiracleLinux 8 : python3-3.6.8-77.el8_10.ML.1 (AXSA:2026-1330:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1330:09 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

RockyLinux 9 : python3.14 (RLSA-2026:41949)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

RockyLinux 10 : python3.14 (RLSA-2026:40856)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

DEBIAN-CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-16420

Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-16418

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-16421

Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-16423

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-16420

Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16418

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-16423

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

GHSA-CJ75-F6XR-R4G7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...