CVE-2026-110146: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-76976: Improper Neutralization of Input During Web Page Generation

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

PT-2026-113498

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A buffer overflow exists in the Animation component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HT...

PT-2026-113502

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in Bindings, which allows a remote attacker to read memory inside the sandbox by using a specially crafted HTML page. Use after free is a memory corruption...

PT-2026-113503

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-113484

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.79 Description A heap-based buffer overflow exists in ANGLE, a compatibility layer that translates OpenGL ES calls to other graphics APIs. This issue allows a remote attacker to potentially...

CVE-2026-92883: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

PT-2026-111681

Name of the Vulnerable Software and Affected Versions unstructured versions prior to 0.24.1 Description The library fails to properly escape output or reject unsafe URL schemes in the to html path within unstructured/documents/ontology.py. This allows untrusted document tags, attributes, text, an...

PT-2026-111851

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

PT-2026-113478

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An information leak exists in the password management component. A remote attacker can use social engineering to trick a user into visiting a crafted HTML page, which allows the attacke...

PT-2026-121826

net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain...

PT-2026-111180

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists where improper sanitization of HTML attributes in syntax-highlighted output allows an...

PT-2026-111445

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists in the DOM: Core & HTML component. Use-after-free is a memory...

PT-2026-111446

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 115.43 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists within the DOM: Core & HTML...

PT-2026-111500

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Thunderbird versions prior to 158 Description A mitigation bypass exists within the DOM: Core & HTML component. Recommendations Update Firefox to version 158. Update Thunderbird to version 158...

CVE-2026-109724: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109725: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109780: Undefined Security Weakness

Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-110228: Improper Neutralization of Input During Web Page Generation

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...