CVE-2026-108831

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...

CVE-2026-108831

A security vulnerability exists in meetecho janus-gateway versions up to 1.4.2 . The issue resides within the Admin API component, specifically in the html/demos/admin.js file. The root cause is the presence of hard-coded credentials , which allows for remote execution of the attack. Public explo...

CLSA-2026-1791804836 golang: Fix of CVE-2026-32289

CVE-2026-32289: html/template - track JS template literal brace depth across if/range branches and include it in context comparison and mangling, so actions inside JS template literals are no longer escaped incorrectly, which could lead to XSS...

firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: firefox: Sandbox escape via use-after-free in DOM component

A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model DOM Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

hugo: Hugo: Stored cross-site scripting via crafted heading identifiers

A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting XSS vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML an...

Security update for go1.27

This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. CVE-2026-78659:...

SUSE-SU-2026:4625-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

EulerOS 2.0 SP13 : perl-HTML-Parser (EulerOS-SA-2026-4176)

According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...

EulerOS 2.0 SP11 : bison (EulerOS-SA-2026-4305)

According to the versions of the bison packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in GNU Bison affected version not known and classified as critical. Affected by this issue is the function execvp of the...

PT-2026-111109

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 Description A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response. Recommendations At the moment, there is no...

PT-2026-111020

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

PT-2026-111066

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-108831: Use of Hard-coded Credentials

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...