118192 matches found
PT-2026-114363
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...
PT-2026-114034
🚨 CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to...
PT-2026-113962
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...
PT-2026-114120
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
Linux Distros Unpatched Vulnerability : CVE-2026-110146
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information vi...
Linux Distros Unpatched Vulnerability : CVE-2026-110141
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...
CVE-2026-103974: Improper Neutralization of Input During Web Page Generation
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...
CVE-2026-110718: Server-Side Request Forgery (SSRF)
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
CVE-2026-110592: Improper Encoding or Escaping of Output
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...
CVE-2026-97315: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...
Google Chrome Microsoft Edge Access Information DoS
The vulnerability in the Navigation component of Google Chrome and Microsoft Edge web browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected data, as well as cause a...
Google Chrome Microsoft Edge DoS
The Animation component vulnerability in Google Chrome and Microsoft Edge web browsers is related to type conversion errors in protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...
V8 JavaScript DoS
The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...
Media Component DoS
The Media component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...
Google Chrome Microsoft Edge Protected Information Access
The vulnerability in the FileSystem component of Google Chrome and Microsoft Edge involves reading protected information beyond its permitted buffer boundaries. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...
Google Chrome Microsoft Edge Passkeys Security Keys Data Compromise
The vulnerability in the Web Authentication component Passkeys and Security Keys of Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protect...
Google Chrome Microsoft Edge DoS
The vulnerability in the Views component of Google Chrome and Microsoft Edge web browsers is related to improper use of memory after it has been freed. Exploiting this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...
Preload Component Protected Information Access
The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the use of a name with an incorrect reference. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...
WebRTC Component Access Protected Information
The WebRTC component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...
Google Chrome Microsoft Edge DoS
The Animation component vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper use of memory after it has been freed. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted HTML page...