119047 matches found
CVE-2026-118317
Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-118318
Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-118318
Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-59158
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, "src/module.ts" unconditionally merges all module options, including a configured cloud "apikey", into "runtimeConfig.public.ollama". Nuxt serializes this public configuration into the...
AZL-111805 CVE-2026-97045 affecting package application-gateway-kubernetes-ingress 1.7.7-7
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
CVE-2026-97045
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
CVE-2026-97045
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
CVE-2026-97045
CVE-2026-97045 impacts multiple packages , specifically involving the golang.org/x/net library. The vulnerability exists in the childTextNodesAreLiteral function, where walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. This behavior f...
CVE-2026-78661
The golang.org/x/net package is vulnerable to a quadratic complexity issue (CWE-407) when coalescing adjacent text nodes via the addText and fosterParent functions. The root cause is that appending to an existing TextNode's data using string concatenation (n.Data += text) triggers a reallocation ...
CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...
GO-2026-6866 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
GO-2026-6860 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...
GHSA-V6MG-96C6-GMPQ CKEditor: Cross-site scripting (XSS) in the engine package
Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...
CKEditor: Cross-site scripting (XSS) in the engine package
Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...
CVE-2026-116687
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute...
UBUNTU-CVE-2026-116687
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute...
CVE-2026-116687
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute...
EUVD-2026-111365
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute...