CSS components Confidential Data Access

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

CSS components Confidential Data Access

The vulnerability of the CSS components in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

[SECURITY] [DLA 4760-1] roundcube security update

Debian LTS Advisory DLA-4760-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 29, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11 CVE ID : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999...

GHSA-W7QW-5WFV-GWX9 Snipe-IT has CSS Injection via `header_color` Setting

Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...

Snipe-IT has CSS Injection via `header_color` Setting

Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...

EUVD-2026-43003

Snipe-IT has CSS Injection via headercolor Setting...

Chromium: CVE-2026-79234 Injection in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-79291 Information leak in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-79770

A flaw was found in Nokogiri. A remote attacker can inject specially crafted CSS selectors into methods such as Nodecss or Nodeatcss. This injection can lead to regular expression denial of service ReDoS due to exponential regex backtracking, causing the application to become unresponsive...

WordPress Nexter Blocks plugin < 5.0.2 - Contributor+ Stored CSS Injection vulnerability

Contributor+ Stored CSS Injection vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Nexter Blocks versions 5.0.2...

SUSE CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

TencentOS Server 3: yelp (TSSA-2026:0898)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0898 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-47666

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

EUVD-2026-66811

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-47666

Penpot (open-source design and prototyping platform) versions up to and including 2.14.3 are affected by a stored XSS via custom font family names. Arbitrary font-family strings are interpolated into a @font-face CSS rule and injected via innerHTML without sanitization, allowing an attacker to br...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-32257

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

SUSE CVE-2026-79291

Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...