CVE-2026-13946

Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13946

Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13946

An inappropriate implementation flaw was discovered in the ScriptInjections component of the Chromium browser. This vulnerability allowed a remote attacker to leak cross-origin data by navigating to a crafted HTML page. The issue was present in Google Chrome on iOS versions prior to 150.0.7871.47...

CVE-2026-13946

Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13836

A vulnerability in the CSS component of Google Chrome (prior to version 150.0.7871.47) and Microsoft Edge allows a remote attacker to inject arbitrary scripts or HTML via a UXSS (User Cross-Site Scripting) attack. This is caused by an inappropriate implementation in CSS that fails to protect web ...

CVE-2026-13836

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-13836

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-13836

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-13812

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-55721 SQL Injection in StoneFly Storage Concentrator

Storage Concentrator SC & SCVM is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those querie...

CVE-2026-55721

Storage Concentrator SC & SCVM is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those querie...

CVE-2026-28322 SolarWinds Database Performance Analyzer Stored Cross-Site Scripting Vulnerability

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

CVE-2025-71368

Summary: CVE-2025-71368 affects picklescan prior to 0.0.30, which fails to detect the doctest.debug_script function when analyzing pickle files. This allows remote attackers to craft malicious pickle payloads embedding doctest.debug_script that bypass picklescan detection and trigger arbitrary co...

CVE-2025-71368 picklescan - Arbitrary Code Execution via Undetected doctest.debug_script

picklescan before 0.0.30 fails to detect the doctest.debugscript function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debugscript calls that bypass picklescan detection and execute arbitrary command...

Malicious code in ecto-corsair-flag-7kq3mz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script...

MAL-2026-6699 Malicious code in ecto-corsair-flag-7kq3mz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script...

MAL-2026-6701 Malicious code in ripshakti (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668 The package's preinstall lifecycle hook scripts.preinstall = "node index.js" auto-executes index.js on npm install. The script queries the AWS instan...

MAL-2026-6697 Malicious code in @sudoughnym/enviro-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c1c204d0f458d13d7140f4b7a007d551095665a418e9146037be9a5b2b7957 @sudoughnym/[email protected] ships preinstall.js and postinstall.js lifecycle scripts that run automatically on npm install. Both scripts collect...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the writeJson process. An attacker can access sensitive information by exploiting the lack of validation on the callback parameter in JSONP responses, allowing cross-origin data retrieval through a crafted...

Stored Cross-Site Scripting (XSS)

DOMPurify is vulnerable to stored cross-site scripting XSS. The vulnerability is due to the setConfig API bypassing the parseConfig clone protection, allowing an uponSanitizeAttribute hook to permanently modify the shared attribute allowlist, which allows an attacker to persistently enable...