119112 matches found
EUVD-2026-101591
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...
CVE-2026-103974
The chess server lichess.org is vulnerable to Stored HTML Injection in its study features. An attacker who can add a chapter to a study can place malicious text within the PGN Annotator tag , which is then stored as Comment.Author.External. When a study node contains at least two comments, the fi...
CVE-2026-103974 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...
CVE-2026-91159
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permissio...
CVE-2026-110718
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
Ammonia HTML Sanitizer – Ammonia Cross-Site Script Vulnerability
Ammonia HTML Sanitizer versions prior to 3.3.2, 4.0.2, and 4.1.3 have a cross-site scripting vulnerability. This vulnerability stems from improper implementation of the encoding-related MathML integration point in annotation-xml. After the attribute filtering removes the encoding, inconsistent...
Google Chrome: Input validation error vulnerability
Versions of Google Chrome prior to 155.0.8059.84 contain a vulnerability related to input validation. This vulnerability arises from improper input validation, and it could allow remote attackers to execute arbitrary code outside of the sandbox through a specially crafted HTML page...
Google Chrome Resource Management Error Vulnerability
Versions of Google Chrome prior to 155.0.8059.84 have a resource management vulnerability. This vulnerability stems from a problem in the V8 engine where objects are reclaimed and then reused. This could allow remote attackers to execute arbitrary code within a sandbox through a specially crafted...
Google Chrome Resource Management Error Vulnerability
Versions of Google Chrome prior to 155.0.8059.84 have a resource management vulnerability. This vulnerability stems from the use of reusing V8 objects after they are released, which may allow remote attackers to execute arbitrary code within a sandbox through a specially crafted HTML page...
CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permissio...
CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permissio...
CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permissio...
CVE-2026-91159
The open-source discussion platform Discourse is vulnerable to a stored oEmbed HTML injection (CWE-79) prior to versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 . The root cause is that oEmbed processing treats an entire attacker-controlled HTML fragment as trusted if it contains an iframe fro...
CVE-2026-110592
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...
DEBIAN-CVE-2026-101895
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...
CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
EUVD-2026-101141
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
CVE-2026-110718
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...