CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content

CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...

CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content

CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...

Vulnerability of the DOM component: Security features in Firefox web browser and Thunderbird email client, which allow attackers to access confidential data

The vulnerability of the DOM component: The security of Firefox web browser and Thunderbird email client is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data remotely...

Vulnerability of the DOM component: Security features in Firefox web browser and Thunderbird email client, which allow attackers to access confidential data and compromise its integrity

Vulnerability of the DOM component: The security of Firefox web browser and Thunderbird email client is related to the lack of data security mechanisms. Exploiting this vulnerability allows a malicious actor to access confidential data and compromise its integrity...

Vulnerability of the DOM component: Security features in Firefox web browser and Thunderbird email client, which allow attackers to access confidential data and compromise its integrity

Vulnerability of the DOM component: The security of Firefox web browser and Thunderbird email client is related to the lack of data security mechanisms. Exploiting this vulnerability allows a malicious actor to access confidential data and compromise its integrity...

Vulnerability of the DOM component: The Core and HTML components in the Firefox web browser and Thunderbird email client, allowing attackers to trigger a service failure.

Vulnerability of the DOM component: The Core and HTML components of the Firefox web browser and Thunderbird email client are vulnerable due to improper restrictions on the visible layers of the user interface. Exploiting this vulnerability could allow a remote attacker to cause service...

Exploit for CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PH...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE sanitization process when a hook removes an element, leaving its detached descendants with executable event handlers. An attacker ca...

Fedora 43 : php (2026-d755ca77c4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d755ca77c4 advisory. PHP version 8.4.24 30 Jul 2026 BCMath: Fixed GHSA-x692-q9x7-8c3f Out-of-bounds write in bccomp. CVE-2026-17544 Recep Asan Calendar: Fixed bug GH-226...

Arbitrary Code Injection

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM...

Arbitrary Code Injection

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of...

The vulnerability of the DOM components in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the DOM components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the DOM components in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the DOM components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

TencentOS Server 4: firefox (TSSA-2026:0788)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0788 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

AlmaLinux 10 : firefox (ALSA-2026:47101)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:47101 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

Astra Linux – Vulnerability in Firefox

DOM sandbox escape: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Firefox

DOM-based sandbox escape: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12...

SUSE CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...