12771 matches found
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...
Unity Linux 20.1070e Security Update: python-lxml (UTSA-2026-104952)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104952 advisory. lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can ...
Snipe-IT vulnerable to stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...
EUVD-2026-42996
Snipe-IT vulnerable to stored XSS via inline-served attachment...
Chromium: CVE-2026-79016 Observable discrepancy in SVG
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability
Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...
Autodesk 3ds Max 2026.x < 2026.3.4 / 2027.x < 2027.2.0 Multiple Vulnerabilities (ADSK-SA-2026-0014)
The version of Autodesk 3ds Max installed on the remote Windows host is 2026.x prior to 2026.3.4, or 2027.x prior to 2027.2.0. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerabilit...
openSUSE 16: libQt6Svg6 / libQt6SvgWidgets6 / qt6-svg-devel / etc (openSUSE-SU-2026:21626-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21626-1 advisory. This update for qt6-svg fixes the following issue: - CVE-2025-10729: use-after-free when processing pattern group nodes bsc1250994. Tenable has extracte...
CVE-2026-49825
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
CLSA-2026-1787820940 TuxCare security update for enshrined/svg-sanitize (1 CVE)
TuxCare rebuilt enshrined/svg-sanitize to address 1 CVE. Fixed in 0.16.0-p1+tuxcare...
SUSE CVE-2026-79016
Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...
TencentOS Server 3: yelp (TSSA-2026:0898)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0898 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
Security update for qt6-svg (important)
openSUSE security update: security update for qt6-svg ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21626-1 Rating: important References: bsc1250994 Cross-References: CVE-2025-10729 CVSS scores: CVE-2025-10729 SUSE : 7...
CVE-2026-79016
A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in how Scalable Vector Graphics SVG are handled by crafting a malicious HTML page. This vulnerability allows the attacker to obtain sensitive cross-origin data, potentially leading to information disclosu...
ComfyUI stored XSS and path traversal vulnerabilities
RISK EVALUATION ComfyUI contains multiple vulnerabilities, with the most severe impact being that a remote, unauthenticated attacker could read image-decodable files and probe arbitrary host paths. 2. RECOMMENDED PRACTICES Fixed in 0.28.0. 3. DESCRIPTION ComfyUI is a modular diffusion model GUI,...
CVE-2024-50803-Redaxo
CVE-2024-50803 XSS memorizzato nella funzionalità mediapool di Redaxo Una vulnerabilità di cross-site scripting XSS memorizzato è stata trovata in Redaxo versioni 5.18.0, consentendo a un attaccante con privilegi sufficienti di caricare un file SVG malevolo attraverso la funzionalità mediapool...
Linux Distros Unpatched Vulnerability : CVE-2026-79016
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...
DEBIAN-CVE-2026-79016
Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...
