PT-2026-89573

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

CVE-2026-88024: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88033: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88030: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-87458

UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...

EUVD-2026-74404

UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87472: Improper Input Validation

Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87501: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87540: Incorrect Authorization

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87599: Improper Input Validation

Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87432: Incorrect Authorization

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87568: Improper Input Validation

Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. Chromium security severity: Low...

The vulnerability of the sctp_wait_for_connect() function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sctpwaitforconnect function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation is related to the lack of measures taken to neutralize numerous internal special elements. Exploiting this vulnerability can allow an attacker to...

GHSA-6MJ3-QW4J-HGRW xmldom: HTML raw-text closing-tag case mismatch causes output amplification

Summary In HTML mode text/html, a raw-text element script, style, textarea, title whose closing tag differs in case from its opening tag e.g. for is mishandled by the parser, producing quadratic On² output growth — a small crafted document parses and serializes into output orders of magnitude...

EUVD-2026-69227

xmldom: HTML raw-text closing-tag case mismatch causes output amplification...

CVE-2026-84820

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

EUVD-2026-72643

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...