CVE-2026-121176: Google Chrome: Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside…

Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121099: Google Chrome: Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136336

Name of the Vulnerable Software and Affected Versions traQ versions prior to 3.28.3 Description Instances configured with TRAQ STORAGE TYPE=local can return user-uploaded SVG or HTML content from the '/files/fileId' retrieval endpoint for direct browser rendering. An attacker with file-upload...

CVE-2026-121234: Google Chrome: Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to…

Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136598

Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136541

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description An information leak exists in the ServiceWorker component. A remote attacker who has already compromised the renderer process can obtain sensitive information by using a specially craft...

PT-2026-136551

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description A security issue in the Platform component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from on...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-120497

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497

A Stored cross-site scripting (XSS) vulnerability exists in the HTML report generator of the aidlc-traceability CLI within AWS AI-DLC Workflows (versions before 2026-07-03). An attacker capable of modifying a project's AI-DLC artifact files can execute arbitrary scripts in a user's browser by cra...

EUVD-2026-115369

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-118016

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation --- CME Mitigation Guidance 2026-11-03 --- Disclaimer: The following mitigation solutions are provided as a courtesy,...

CVE-2026-118013

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Layout: Images, Video, and HTML Frames component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are...

CVE-2026-120443 GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

EUVD-2026-115203

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...