PT-2026-120901

The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by t...

Linux Distros Unpatched Vulnerability : CVE-2026-113036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-113329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Google Chrome Microsoft Edge Data Compromise

The Parser component vulnerability in Google Chrome and Microsoft Edge is related to a lack of secure information handling mechanisms. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

GitHubNewbie0 odf-kit cross-site scripting vulnerability

In version 0.10.0 through 0.14.2 of the odf-kit for GitHubNewbie, there is a cross-site scripting vulnerability. This occurs because the HTML renderer fails to escape inline CSS style values; attributes such as fo:color are directly concatenated into the style attribute, potentially enabling...

Linux Distros Unpatched Vulnerability : CVE-2026-109724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Linux Distros Unpatched Vulnerability : CVE-2026-113657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17....

Enterprise component DoS

The vulnerability in the Enterprise component of Google Chrome and Microsoft Edge web browsers is related to improper code generation management. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted HTML page...

PT-2026-120591

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

WebProtect Component Access Information Disclosure

The vulnerability in the WebProtect component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTM...

Google Chrome Microsoft Edge DoS

The vulnerability in the Extensions component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the Settings component of Google Chrome and Microsoft Edge web browsers is related to a flaw in the source verification mechanism. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the Scheduling component of Google Chrome and Microsoft Edge web browsers is related to insecure privilege management. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Media Component DoS

The Media component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

SiteIsolation Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the SiteIsolation component of Google Chrome and Microsoft Edge web browsers is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...

PT-2026-120903

The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by th...

Linux Distros Unpatched Vulnerability : CVE-2026-113157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page...

Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by t...