PT-2026-85241

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description An out of bounds read exists in the CrashReporting component. This allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using ...

PT-2026-85235

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A high-severity type confusion issue exists in the V8 JavaScript and WebAssembly engine. This flaw occurs when the V8 optimizer incorrectly validates the element type of an array during...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-83547

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15692

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-70047

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547

Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15692 Icegram Express < 5.8.6 - Admin+ Stored XSS

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15692 Icegram Express < 5.8.6 - Admin+ Stored XSS

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15692

CVE-2025-15692 affects the Icegram Express WordPress plugin prior to version 5.8.6 . The root cause is improper escaping of a list description setting before it is output within an HTML attribute , enabling Stored Cross-Site Scripting (XSS) attacks. Exploitation requires an authenticated user wit...

EUVD-2025-210828

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-84371

A flaw was found in sanitize-html. Improper validation of the animation value attributes in SVG files allows an attacker to bypass scheme filters and embed a malicious script destination within a list of values. When a user interacts with the rendered SVG animation, the embedded script executes i...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

wget security, bug fix, and enhancement update

An update is available for wget. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS,...

SUSE CVE-2026-84332

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-84348

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Medium...