115083 matches found
CVE-2026-100694
The static site generator Hugo versions v0.56.0 through v0.165.x are vulnerable to Cross-Site Scripting (XSS) . The root cause is that content files mapped to the text/org media type render Org export blocks and @@html:...@@ snippets without proper HTML escaping. An attacker capable of influencin...
CVE-2026-100694 Hugo before 0.166.0 Cross-Site Scripting via text/org
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
EUVD-2026-87667
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
EUVD-2026-87767
The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...
CVE-2026-100641
SiYuan versions before v3.8.4 are vulnerable to a Stored XSS flaw because they fail to HTML-escape stored flashcard block content. Specifically, content retrieved from the /api/riff/getRiffCards endpoint is inserted into app/src/card/viewCards.ts and assigned to listElement.innerHTML without prop...
EUVD-2026-87735
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100639
SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...
EUVD-2026-87724
AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
Astra Linux – Vulnerability in Chromium
In Google Chrome, policy bypass in CSS before version 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
An observable discrepancy in forms in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after free in WebRTC in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the UI of Google Chrome before version 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Information leakage in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
In Google Chrome on Linux, before version 150.0.7871.125, using free after UI interactions allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...