CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

SUSE CVE-2026-19872

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 contain a stored XSS vulnerability caused by missing HTML-escaping of plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). An attacker with write access to the plugins directory can create a plugin whose d...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

EUVD-2026-75896

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

ROS-20260911-73-0212

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0189

The vulnerability in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

ROS-20260911-73-0178

The vulnerability of the Guest mode in Google Chrome browser is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to carry out spam attacks using a specially created HTML page...

ROS-20260911-73-0134

The vulnerability of the WebXR component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0130

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0059

The vulnerability of the DeviceBoundSessionCredentials component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0053

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0042

The vulnerability of the HTML component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

ROS-20260911-73-0036

The vulnerability of the GPU components in Google Chrome and Microsoft Edge browsers is related to buffer overflows in the stack. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260911-73-0243

The vulnerability of the Canvas component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260911-73-0235

The vulnerability of the GPU components in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...