119114 matches found
CVE-2026-110146: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...
PT-2026-111180
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists where improper sanitization of HTML attributes in syntax-highlighted output allows an...
PT-2026-111300
Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...
Google Chrome Microsoft Edge Unauthorized Access
The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability enables a remote attacker to gain unauthorized access to protected data via a specially crafted HTML page...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to incomplete cleanup of temporary or auxiliary resources. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTM...
Network service Google Chrome Microsoft Edge Access Information Disclosure
The vulnerability in the Network services of Google Chrome and Microsoft Edge is related to insufficient protection of sensitive data. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...
Network service Google Chrome Microsoft Edge Access Information Disclosure
The vulnerability in the Network browser services of Google Chrome and Microsoft Edge stems from a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to gain access to protected information via a specially crafted HTML page...
Network services DoS
The vulnerability in the Network browser services of Google Chrome and Microsoft Edge is related to insufficient input validation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...
Google Chrome Microsoft Edge Access Information Disclosure
The Autofill function vulnerability in Google Chrome and Microsoft Edge is related to a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to gain access to protected information via a specially crafted HTML page...
Google Chrome Microsoft Edge Access Information Disclosure
The Autofill function vulnerability in Google Chrome and Microsoft Edge is related to a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to gain access to protected information via a specially crafted HTML page...
SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:4625-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4625-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...
PT-2026-113484
Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.79 Description A heap-based buffer overflow exists in ANGLE, a compatibility layer that translates OpenGL ES calls to other graphics APIs. This issue allows a remote attacker to potentially...
PT-2026-113478
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An information leak exists in the password management component. A remote attacker can use social engineering to trick a user into visiting a crafted HTML page, which allows the attacke...
CVE-2026-76976: Improper Neutralization of Input During Web Page Generation
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...
PT-2026-111350
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...
CVE-2026-104937: Undefined Security Weakness
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...
PT-2026-113503
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...
PT-2026-113473
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An observable discrepancy in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using...
PT-2026-111851
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...
PT-2026-113498
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A buffer overflow exists in the Animation component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HT...