CVE-2026-95371

Google Chrome on Mac prior to version 154.0.8037.57 is vulnerable to a missing authorization flaw in Views . A remote attacker who has already compromised the renderer process can leverage social engineering to spoof UI elements via a crafted HTML page. This issue is rated as Medium severity by C...

EUVD-2026-89124

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-46490-samlify-SAML-Attribute-Injection

CVE-2026-46490 — samlify SAML AttributeValue XML 삽입 → 권한 상승 samlify Value에 배치되면 이스케이프되지 않은 상태로 삽입되므로, 일반 사용자가 추가 요소 예: role=admin를 자신의 IdP 서명된 SAML 어설션에 주입할 수 있습니다. 서명 전에 삽입이 발생하므로 서비스 제공자의 서명 확인이 통과되고 위조된 속성을 신뢰합니다. | ---|--- CVE| CVE-2026-46490 권고| GHSA-34r5-q4jw-r36m 영향| samlify rawXML =...

CVE-2026-0920

CVE-2026-0920 스캐너 취약한 LA-Studio Element 플러그인 버전을 사용하는 WordPress 사이트에서 CVE-2026-0920 노출을 탐지 및 검증하기 위한 Python 기반 스캐너입니다. 개요 이 도구는 취약한 플러그인 버전의 등록 흐름에서 부적절한 역할 처리와 관련된 취약점인 CVE-2026-0920 의 영향을 받을 가능성이 있는 WordPress 대상을 자동으로 식별하도록 설계되었습니다. 스크립트는 대상 목록을 처리하고, 검증 확인을 시도하며, 성공적인 결과를 나중에 검토할 수 있도록 출력 파일에...

CVE-2026-0920

CVE-2026-0920 - WordPress Plugin LA-Studio Element Kit / Unauthenticated Privilege Escalation A proof-of-concept exploit for CVE-2026-0920 , an unauthenticated privilege-escalation vulnerability in the LA-Studio Element Kit WordPress plugin. The vulnerability allows an unauthenticated attacker to...

CVE-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-94181

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

EUVD-2026-85565

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181

Affected versions of the Arc browser are susceptible to an address bar spoofing issue. An attacker can spoof the browser address bar by utilizing a element that triggers requestFullscreen without displaying the standard fullscreen notification. Exploitation details are not provided in the docume...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

DRUPAL-CONTRIB-2026-159

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripti...

DRUPAL-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...