119549 matches found
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...
firefox: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component...
Important: Red Hat Security Advisory: skopeo security update
An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
PT-2026-98196
Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...
CVE-2026-4637: Improper Neutralization of Input During Web Page Generation
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...
RockyLinux 9 : skopeo (RLSA-2026:70641)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion...
AlmaLinux 9 : buildah (ALSA-2026:70640)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...
CVE-2026-61825: Improper Neutralization of Input During Web Page Generation
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...
CVE-2026-57440: Improper Neutralization of Input During Web Page Generation
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...
PT-2026-98202
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The topic small-action and nested-activity-log components interpolate the free-form...
PT-2026-98243
Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in SharpEditorFormField. Attacker-controlled content using the data-html-content attribute can bypass HTML sanitization, allowing executable markup to...
CVE-2026-91119: Improper Neutralization of Input During Web Page Generation
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...
Fedora 45 : perl-HTML-FormHandler (2026-406a152d49)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-406a152d49 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...
PT-2026-97827
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.2.0-alpha Description A stored cross-site scripting XSS issue exists that allows unauthenticated users or low-privileged registered users to inject arbitrary JavaScript. The attack occurs when an administrator...
RockyLinux 9 : buildah (RLSA-2026:70640)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...
AlmaLinux 9 : skopeo (ALSA-2026:70641)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion ...
RHEL 9 : buildah (RHSA-2026:70640)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70640 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...
VulnCheck KEV: CVE-2022-28368
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...