CVE-2026-112148

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

EUVD-2026-104810

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

CVE-2026-112148

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

CVE-2026-112148

A DOM-based cross-site scripting (XSS) flaw exists in the LIFF SDK versions 2.20.0 through 2.31.0 . An attacker can execute arbitrary JavaScript within the origin of an affected LIFF application's endpoint by tricking a user into opening a specially crafted URL in an external browser. This could ...

XSS-cross-site-scripting-Payloads

XSS Payloads A comprehensive collection of XSS Cross-Site Scrip...

PT-2026-118354

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW EXTERNAL IMAGE SOURCES is enabled. Attackers can se...

PT-2026-118884

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue in the DOM allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use after free is a...

PT-2026-118940

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the DOM Document Object Model, which is the programming interface for HTML and XML documents. This issue allows a remote attacker to potentially execute...

Fedora 43 : chromium (2026-5a871d2ca7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5a871d2ca7 advisory. Update to 155.0.8059.84, includes 10 security fixes CVE-2026-110913: Memory corruption in DOM CVE-2026-110914: Memory corruption in Workers...

PT-2026-118249

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

Google Chrome Vulnerability: CVE-2026-113187

Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118508

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2 Description A client-side prototype pollution issue exists in the apos.http.parseQuery function. The parser fails to sanitize the proto , constructor, and prototype keys when processing URL...

PT-2026-118267

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into...

Google Chrome Vulnerability: CVE-2026-113243

Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-111059

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Privilege escalation in the DOM: Service Workers component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component...

firefox: firefox: Sandbox escape via use-after-free in DOM component

A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model DOM Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code...

firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component...