CrashReporting Component DoS

The vulnerability in the CrashReporting component of Google Chrome and Microsoft Edge web browsers is related to an out-of-bounds memory operation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the FileAPI component of Google Chrome and Microsoft Edge is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

DataTransfer Component Protected Information Access

The vulnerability in the DataTransfer component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted...

Google Chrome Microsoft Edge DoS

The vulnerability in the DataTransfer component of Google Chrome and Microsoft Edge web browsers is related to the lack of request source preservation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Web Packaging DoS

The Webpacking component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The Printing component vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper use of memory after it has been freed. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Safebrowsing Component Access Disclosure

The Safebrowsing component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of unusual or exceptional states. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML pag...

Prerender Component Protected Information Access

The Prerender component vulnerability in Google Chrome and Microsoft Edge is related to the lack of request source preservation. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Passwords Component Access Information Disclosure

The vulnerability in the Password component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted...

Google Chrome Microsoft Edge DoS

The vulnerability in the File Input component of Google Chrome and Microsoft Edge web browsers is related to insecure privilege management. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the file upload handling in FileField.php and ImageField.php, where uploaded SVG and HTML files are stored without sanitizing active content before being served. An authenticated attacker can upload a...

CVE-2026-116206

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter,...

CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter,...

CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter,...

CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter,...

EUVD-2026-109464

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter,...

CVE-2026-116206

YesWiki versions 4.2.0 before 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the use of the Twig raw filter to render comments submitted via the /api/comments endpoint, which allows authenticated users to inject scripts using wakka raw-HTML syntax . This can r...

CVE-2026-115183

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

EUVD-2026-109351

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

[SECURITY] Fedora 43 Update: perl-Markdown-Render-2.0.4-1.fc43

Renders markdown as HTML using either GitHub's API or Text::Markdown::Discount. Optionally adds additional metadata to markdown document using custom tags...