Linux Distros Unpatched Vulnerability : CVE-2026-117868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-117901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Linux Distros Unpatched Vulnerability : CVE-2026-117976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-118661: Reliance on Cookies without Validation and Integrity Checking

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118660: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118659: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118254: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-109370: bplugins Document Embedder – let visitors read files without downloading: The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored…

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

Linux Distros Unpatched Vulnerability : CVE-2026-118016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118016 Note that Nessus relies on th...

Linux Distros Unpatched Vulnerability : CVE-2026-118012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118012 Note that Nessus relies on the...

WordPress AI Marketing Expert cross-site scripting vulnerability

WordPress AI Marketing Expert versions 1.2.8 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. It allows stored DOM-based cross-site scripting attacks via the ‘name’ parameter. Unauthenticated attackers can inject...

David Ortner Happy DOM server-side request forgery vulnerability

David Ortner: Versions prior to Happy DOM 21.0.0 contain a server-side request forgery vulnerability. This vulnerability arises because, when parsing untrusted HTML on the server, the default behavior loads iframe src URLs and link rel="stylesheet" href URLs. This may lead to server-side request...

Linux Distros Unpatched Vulnerability : CVE-2026-117881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

PT-2026-127874

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for...

Linux Distros Unpatched Vulnerability : CVE-2026-117968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...