CVE-2026-87620

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87620

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87620

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-74448

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87620: Observable Discrepancy

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-75307: Improper Neutralization of Input During Web Page Generation

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

PT-2026-89165

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

CVE-2026-75307

The software zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) . The flaw exists in the SVG file upload functionality accessible via the /equipmentFile/upload endpoint. This vulnerability allows for the execution of malicious scripts in a user's browser. While the vulnerability is docu...

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

Linux Distros Unpatched Vulnerability : CVE-2026-87620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromiu...

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

EUVD-2026-69653

SVGO: removeScripts allows executable links through namespace and control-character bypasses...

GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

GHSA-4VPR-X523-8J87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

CVE-2026-86644

star7th showdoc up to 3.9.1 contains a cross-site scripting (XSS) vulnerability in the file web_src/public/editor.md/editormd.js , triggered through the API Page Save Endpoint . The flaw allows a remote, authenticated attacker to execute arbitrary script via manipulation of the editor component. ...

EUVD-2026-72760

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

CVE-2026-86644 star7th showdoc API Page Save Endpoint editormd.js cross site scripting

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

PT-2026-88720

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An observable discrepancy in SVG allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to versio...