PT-2026-91731

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...

ROS-20260914-73-0023

The vulnerability of the Cast component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...

PT-2026-91179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Amazon Linux 2023 : jsoup (ALAS2023-2026-2150)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2150 advisory. jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to...

ROS-20260914-73-0025

The vulnerability of the WebGL component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-91103

Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introdu...

ROS-20260914-73-0113

The vulnerability of the Network component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0052

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-81900: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 applied only trim to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with editblock permission could inject an event handler that execute...

ROS-20260914-73-0054

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0079

The vulnerability of the Audio component in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260914-73-0088

The vulnerability of the Views component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0065

The vulnerability of the Compositing component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0026

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0114

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-91260

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

ROS-20260914-73-0008

The vulnerability of the Google Chrome browser’s graphics processor is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to access confidential information through a specially created HTML page...

anki -- multiple vulnerabilities

Abdo Hasani reports: Imported note HTML may execute inside an embedded image-occlusion document that retains the editor profile's desktop API credentials. This could cross the boundary between untrusted note content and privileged desktop operations. An improper path validation vulnerability allo...

ROS-20260914-73-0070

The vulnerability of the Paint component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260914-73-0019

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...