16702 matches found
CVE-2026-112849 WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0...
CVE-2026-112849 WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0...
EUVD-2026-108955
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0...
CVE-2026-112849
The AivahThemes Hostme v2 WordPress theme (versions
CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...
CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...
CVE-2026-55422
The conda-forge website is vulnerable to Stored DOM XSS due to the unsanitized use of dangerouslySetInnerHTML in two React components within the status dashboard. The root cause is that the site renders raw output—such as build logs and tracebacks—captured by the autotick bot (regro/cf-scripts) d...
CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...
Security Bulletin: IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.
Summary IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site ScriptingXSS attacks. CVE-2016-1000240, CVE-2020-11023, CVE-2026-101117 Vulnerability Details CVEID:CVE-2016-1000240 DESCRIPTION: Node.js C3.js c3 module is vulnerable to cross-site scripting, caused by improper...
AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792779937)
The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792779937 advisory. - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi...
David Ortner happy-dom code injection vulnerability
In versions 17.0.0 through 21.0.4 of David Ortner’s happy-dom, there is a code injection vulnerability. This vulnerability arises because ECMAScriptModuleCompiler.ts fails to validate whether imported ESM alias names are valid JavaScript binding identifiers before inserting them into generated...
PT-2026-122239
Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...
AivahThemes Hostme v2 cross-site scripting vulnerability
AivahThemes Hostme v2 versions 7.0 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially leading to DOM-based cross-site scripting attacks...
npm: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
npm: DOMPurify SAFEFORTEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.4, = 3.4.16...
VulnCheck KEV: CVE-2026-97237
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3...
CVE-2026-113243
A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by tricking a user into loading a crafted HTML page. The flaw is caused by a memory corruption error during Document Object Model DOM processing...
CVE-2026-109732
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Streams component...
CVE-2026-109717
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Bindings WebIDL component...
CVE-2026-113110
A flaw was found in chromium-browser. A memory corruption issue exists within the browser's Shadow DOM component. A remote attacker could exploit this vulnerability by enticing a user to load a specially crafted HTML page, potentially allowing arbitrary code execution within the browser sandbox...
