CVE-2026-95346

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95346

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95294

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102496

A flaw was found in Apache XMLSchema. When constructing its schema model, the parser does not restrict how deeply schema structures can be nested. A remote attacker could exploit this vulnerability by providing a crafted XML schema containing deeply nested elements, triggering uncontrolled...

https-nj.gov---CVE-2020-11023

https-nj.gov---CVE-2020-11023 Vulnearability Report of the New Jersey official site Potential XSS vulnerability when appending HTML containing option elements. Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e...

CVE-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95309): chromium -- security fixes

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95346): chromium -- security fixes

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. Chromium security severity: Medium...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95288): chromium -- security fixes

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95321): chromium -- security fixes

UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

EUVD-2026-75681

Angular SSR: XSS via Unescaped Processing Instruction Nodes in Fallback Raw-Content Elements...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

CVE-2026-9018

CVE-2026-9018 CVE-2026-9018 — Easy Elements for Elementor ≤ 1.4.5 | Elevación de Privilegios No Autenticada Investigación por: Atomic Edge Severidad: Alta | CVSS: 8.8 | Autenticación requerida: Ninguna Descripción general Existe una vulnerabilidad de elevación de privilegios no autenticada en el...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 — Adobe Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the conte...

CVE-2024-56115

CVE-2024-56115 Suggested description A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It allows remote attackers to conduct an Cross-Site Scripting XSS attack. Vulnerability Type CWE-78 | Improper Neutralization of Special Elemen...

CVE-2021-30632

From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 The analysis of this bug can be found here. This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild. The exploit here is tested on v8 version...

CVE-2026-91765

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...