CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

EUVD-2026-89476

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

[SECURITY] Fedora 45 Update: epiphany-51.0-1.fc45

Epiphany is the web browser for the GNOME desktop. Its goal is to be simple and easy to use. Epiphany ties together many GNOME components in order to let you focus on the web content, instead of the browser application...

MAL-2026-17418 Malicious code in future-scripts (npm)

On October 10, 2026 local time, boom calls localStorage.setItem'key', i 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges calls boom before input validation; the bundled source map confirms this path. Version 0.0.3...

CVE-2026-102459: Improper Neutralization of Input During Web Page Generation

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-103087: Uncontrolled Recursion

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

CVE-2026-96835: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.85 versions...

CVE-2026-93512: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JW Player for WordPress = 2.3.11 versions...

PT-2026-102971

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

PT-2026-103277

Congratulations to Manthan Shirwadkar for identifying and reporting a security flaw in the EinkBro Android browser, now tracked as CVE-2026-94560. His work helps the wider community adopt better security practices. Read more: https://t.co/lYmKGI1BHx Tinycrows CyberSecurity https://t.co/RtJwJRGXEm...

CVE-2026-89193: Improper Neutralization of Input During Web Page Generation

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

RHEL 8 : webkit2gtk3 (RHSA-2026:74084)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74084 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

KLA91316 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service vulnerabili...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-71189

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-102325

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=561994362 https://code.google.com/p/chromium/issues/detail?id=102325...

CVE-2026-102326

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=560233248 https://code.google.com/p/chromium/issues/detail?id=102326...

CVE-2026-102315

An uninitialized resource flaw was found in the Media component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=563351482 https://code.google.com/p/chromium/issues/detail?id=102315...