firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

GHSA-C8P4-J97H-3VG8 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.6...

EUVD-2026-112467

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660

Prior to version 21.0.0 , the Happy DOM JavaScript library is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the library defaults disableIframePageLoading and disableCSSFileLoading to false, causing it to automatically load iframe src and link rel="stylesheet" URLs when...

GHSA-58G7-7F52-H92C Highcharts Dashboards parses fullscreen labels as HTML

Impact The edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. An attacker who controls the Dashboards language options can supply markup carrying event handlers, which then execute in the origin of the page hosting the dashboard. Exploitation requires that...

Highcharts Dashboards parses fullscreen labels as HTML

Impact The edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. An attacker who controls the Dashboards language options can supply markup carrying event handlers, which then execute in the origin of the page hosting the dashboard. Exploitation requires that...

GHSA-65HG-CF3F-5M39 Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Impact When the HTML text parser cannot obtain a document from DOMParser because the call throws, it falls back to assigning the raw markup to the innerHTML of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards. In Chromium the Trusted...

npm: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

npm: Highcharts Core: HTML text parsing falls back to unfiltered innerHTML during printing vulnerability discovered by ? in WordPress npm highcharts versions = 12.0.0, 12.6.1...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118252

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing...

CVE-2026-118648

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and...

CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

EUVD-2026-112359

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...