60825 matches found
CVE-2026-95385
An inappropriate implementation flaw was found in the PlatformIntegration component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517192965...
CVE-2026-95289
An incorrect authorization flaw was found in the Scroll component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549911100...
CVE-2026-95360
A race condition flaw was found in the Editing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517584808...
CVE-2026-95330
An improper state validation flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517163294...
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...
EUVD-2026-52744
@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...
CVE-2026-95381
An improper input validation flaw was found in the Printing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497603247...
SUSE CVE-2026-100817
Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...
SUSE CVE-2026-102514
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
EUVD-2026-91132
This vulnerability enables unauthenticated remote code execution RCE on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an...
PT-2026-104395
Name of the Vulnerable Software and Affected Versions prosemirror-view versions prior to 1.42.3 Description The view component, which manages the editable browser interface for documents, contains a flaw in its paste handling. It accepts attacker-provided HTML where the clipboard slice context...
PT-2026-105490
Summary The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button,...
CVE-2026-104847: Improper Neutralization of Input During Web Page Generation
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
CVE-2026-102514
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
CVE-2026-93832
A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps...
CVE-2026-102514
PeaZip 11.2.0 and earlier versions are vulnerable to an Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component. The vulnerability occurs during PCOMPRESS1 stream decompression, where the 32-bit compsize field of the first bl...
EUVD-2026-91054
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
CVE-2026-93832
A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps...