freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2020-13889

Author: Andre k Lorenci Contact: [email protected] CVE-2020-13889 Hello, this vulnerability consists in a function called showAlert in the administration panel of bludit,that when accessed in DOM, allows users define the text to be popped up in the message box. But this function dont have an...

CVE-2026-118015

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-119267

A memory corruption flaw was found in the DOM component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/576203565...

CVE-2026-119267

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118660

A flaw was found in happy-dom. By default, external resources such as inline frame iframe sources and stylesheets are automatically fetched when parsing HTML documents on the server. A remote attacker who supplies untrusted HTML can trigger Server-Side Request Forgery SSRF, forcing the applicatio...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118661

A flaw was found in happy-dom. The cookie management component fails to properly validate and match domain attributes, allowing it to accept cookies for unrelated domains and match hostnames without enforcing domain boundaries. In server-side rendering environments, a remote attacker controlling ...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor WordPress plugin (versions ≤ 2.7.9 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the _elementor_data.form_fields[].custom_id parameter. An attack...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-113714

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-117860

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DOM: Navigation component...

DEBIAN-CVE-2026-119267

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119267

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

chromebackdoor

Chrome browser backdoor VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go python chromebackdoor.py user: root pass:...

CVE-2026-119267

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-113436

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119267

Google Chrome versions prior to 156.0.8078.79 are vulnerable to a memory corruption flaw within the DOM component. A remote attacker could leverage this vulnerability to potentially execute arbitrary code inside the sandbox by facilitating a crafted HTML page . The issue has been addressed in the...