Google Chrome Microsoft Edge DoS

The vulnerability in the FileSystem component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Sandbox DoS

The vulnerability in the Sandbox component of Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability allows a remote attacker to cause a denial of service by using a specially crafted HTML page...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML pa...

Google Chrome USB Component Compromise

The vulnerability in the USB components of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

GPU Component DoS

The vulnerability in the GPU components of Google Chrome and Microsoft Edge is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

PT-2026-114363

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...

Skia Component Protected Information Access

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Skia Component Protected Information Access

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

CVE-2026-97315: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...

CVE-2026-103974: Improper Neutralization of Input During Web Page Generation

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-110718: Server-Side Request Forgery (SSRF)

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-110592: Improper Encoding or Escaping of Output

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the Chrome Tabs component of Google Chrome and Microsoft Edge is related to insufficient neutralization of special elements within requests. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially...

CVE-2026-110172

Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110165

Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-110167

Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-110162

Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-110166

Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110146

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-110146

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...