Astra Linux – Vulnerability in Chromium

Before version 153.0.8010.36, using V8 in Google Chrome allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

In Google Chrome’s Webpacking functionality, use after free was permitted prior to version 153.0.8010.36; this allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: Low...

Astra Linux – vulnerability in Chromium

A race condition in ReadAloud in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to exploit social engineering techniques to execute arbitrary code within the sandbox by using a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Prior to version 153.0.8010.36, using “After Free” in Input within Google Chrome allowed a remote attacker to execute arbitrary code within the sandbox by using a specially crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Prior to version 153.0.8010.36, improper representation of UI elements in Google Chrome allowed a remote attacker to exploit social engineering techniques to spoof UI elements through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

Improper implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

Prior to version 153.0.8010.36, using “After Free” in Payments within Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox by using a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Improper implementation in HTML within Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151

The Post Grid WordPress plugin versions prior to 7.9.5 is vulnerable to HTML injection due to an improper limitation of the WordPress allowed-HTML list. Specifically, the plugin fails to restrict the expansion of this list to its own markup, applying it site-wide. This allows users with the Contr...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability

Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...