Google Chrome Microsoft Edge Unauthorized Access

The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability enables a remote attacker to gain unauthorized access to protected data via a specially crafted HTML page...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to incomplete cleanup of temporary or auxiliary resources. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTM...

PT-2026-111445

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists in the DOM: Core & HTML component. Use-after-free is a memory...

PT-2026-111446

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 115.43 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists within the DOM: Core & HTML...

CVE-2026-93892

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-109653

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109601

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2024-58391

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2023-54408

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2026-93892

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to an information disclosure vulnerability (CWE-200). A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response in the Admin console. To remediate th...

CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-109601

The Frappe Framework is vulnerable to an arbitrary file read vulnerability in versions before 15.117.0 and 16.x before 16.30.0 . The root cause lies in the handling of attributes within outgoing email HTML content. An attacker capable of supplying outgoing email content can set an attribute value...

CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2023-54408 Frappe before 14.31.0 HTML Injection via Weak Escaping

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2023-54408

Frappe versions before 13.52.0 and 14.x before 14.31.0 are vulnerable to an HTML injection vulnerability. The root cause is weak escaping of user-supplied content rendered within pages. An attacker can submit crafted HTML that bypasses insufficient escaping mechanisms, causing it to execute in th...