CVE-2026-106376

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106258

Google Chrome on Windows versions prior to 155.0.8059.39 is vulnerable to a high-severity issue involving an uninitialized resource in the ANGLE component. A remote attacker can exploit this vulnerability by serving a crafted HTML page to read memory outside the sandbox. This vulnerability is add...

EUVD-2026-93801

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93803

Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93804

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106215

Google Chrome on Windows versions prior to 155.0.8059.39 is vulnerable to an uninitialized resource in the ANGLE component. A remote attacker could exploit this by hosting a crafted HTML page, which allows them to read memory outside the sandbox . This issue has been addressed in the stable chann...

CVE-2026-102322

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-102322

A vulnerability in Google Chrome (prior to version 155.0.8059.39 ) allows a remote attacker to execute arbitrary code through a crafted HTML page. The root cause is an Incorrect Authorization flaw within the SiteIsolation component. The security severity is rated as High by Chromium, and the CVSS...

CVE-2026-106347

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-93796

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-93799

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93794

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-106197

A Use after free vulnerability exists in the Google Chrome browser in versions prior to 155.0.8059.39 . This flaw allows a remote attacker to execute arbitrary code outside the sandbox by navigating the user to a crafted HTML page . While the severity is rated as Critical , no specific exploit li...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-106107 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

CVE-2026-106107 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

CVE-2025-0994

CVE-2025-0994 此检测方法的工作原理？ 该Nuclei模板提取HTML body中存储的版本号，根据版本号我们可以判断该实例是否存在CVE-2025-0994漏洞。 补丁版本：15.8.9 如何运行此脚本？ 1. 从此处下载Nuclei 2. 将模板复制到本地系统 3. 运行以下命令：nuclei -u https://yourHost.com -t template.yaml 参考链接 https://thehackernews.com/2025/02/cisa-warns-of-active-exploitation-in.html...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 Vulnerabilidad descubierta por mí CVE-2019-15053 Aviso: advisory.txt Información Básica Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Tested...