CVE-2026-110166

A buffer overflow flaw exists in the Animation component of the Google Chrome browser (prior to version 155.0.8059.79 ). This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox by navigating to a crafted HTML page . The flaw was reported by Syn4pse and is classifi...

CVE-2026-110146

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-110146

Google Chrome is affected by an information leak flaw in the Passwords component. A remote attacker can leverage social engineering to obtain sensitive information by navigating the user to a crafted HTML page . This vulnerability impacts versions prior to 155.0.8059.79 . Remediation is available...

CVE-2026-110146

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-110146

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-110162

A use after free vulnerability in the Desktop component of Google Chrome (prior to version 155.0.8059.79 ) allows a remote attacker to execute arbitrary code inside the sandbox. This can be triggered by visiting a crafted HTML page . The issue was reported by Findingz and is addressed in the stab...

CVE-2026-110170

Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110152

A heap-based buffer overflow exists in the ANGLE component of Google Chrome on Android prior to version 155.0.8059.79 . A remote attacker could exploit this vulnerability by serving a crafted HTML page to a victim, potentially leading to arbitrary code execution outside the sandbox . This issue w...

CVE-2026-110149

Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-110149

Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-110228

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-104937

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

CVE-2026-110228 wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-110228

The wallabag application versions 2.6.13 through 2.6.14 is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability occurs during a failed Pocket HTML , Pocket CSV , or Shaarli import. An authenticated attacker can upload an HTML file containing scripts but no anchor elements, wh...

CVE-2026-110228 wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-110228

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-110228 wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

EUVD-2026-99012

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

EUVD-2026-99209

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

CVE-2026-110103

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...