ROS-20260915-73-0038

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

ROS-20260915-73-0023

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0020

The vulnerability of the Blink component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260915-73-0004

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-92130

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/single pages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

PT-2026-92114

Name of the Vulnerable Software and Affected Versions Design Scuole Italia affected versions not specified Description The Firma Circolare feature allows an authenticated attacker to perform stored HTML injection. By manipulating the sign parameter, an attacker can inject arbitrary HTML to force...

ROS-20260915-73-0071

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0083

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to manipulate data integrity through a specially created HTML page...

ROS-20260915-73-0146

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

ROS-20260915-73-0144

The vulnerability of the Printing component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-92018: Protection Mechanism Failure

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

PT-2026-93139

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use-after-free issue exists in the Internals component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-93143

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An observable discrepancy in CSS allows a remote attacker to leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to version...

RockyLinux 9 : image-builder (RLSA-2026:67138)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67138 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

CVE-2026-54503: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, includi...

CVE-2026-92022: Use After Free

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

ROS-20260915-73-0132

The vulnerability of the InterestGroups component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-91958

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Firefox ESR versions prior to 115.41 Firefox ESR versions prior to 140.16 Firefox ESR versions prior to 153.3 Thunderbird versions prior to 156 Thunderbird versions prior to 140.16 Thunderbird versions prior to...

CVE-2026-91741: Access of Resource Using Incompatible Type

Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

ROS-20260915-73-0199

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...