CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi I recently identified a security vulnerability in nilsteampassnet/teampass, a popular password management tool. This vulnerability, identified as CVE-2023-2591, is a stored HTML injection vulnerability in the ite...

Dolibarr <7.0.2 - Cross-Site Scripting

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. id: CVE-2018-10095 info: name: Dolibarr 7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium...

CVE-2021-41074

CVE-2021-41074 CSRF in Qloapps HotelCommerce 1.5.1 There is a CSRF in HotelCommerce 1.5.1. It can allow anyone to change the admin email. If an attacker gets an admin to click a maliciously crafted html document, they can change the admin user email...

VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

CVE-2026-84164: Ericsson CodeChecker: The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate…

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script ta...

CVE-2026-123840: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs...

CVE-2026-123851: JetBrains Junie GitHub Action: In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters...

CVE-2026-78661

A flaw was found in golang.org/x/net/html. A remote attacker can cause a Denial of Service DoS by providing specially crafted HTML input containing numerous short text fragments separated by ignored tags. When combining adjacent text nodes, the parser repeatedly reallocates and copies memory for...

CVE-2026-88986

Prior to version 2.15.0 , Kubeflow Pipelines is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where the frontend/server/k8s-helper.ts component includes untrusted podname and podnamespace...

CVE-2026-88986

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser's security sandbox, leading to information...

CVE-2026-101895

A flaw was found in Angular's platform-server component. When performing Server-Side Rendering SSR, the HTML parser fails to properly handle malformed DOCTYPE declarations that end with trailing whitespace, leading to an infinite processing loop. A remote, unauthenticated attacker can exploit thi...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence AI company in June 2026 as an optional setting to minimize data exfiltration...