119734 matches found
ROS-20260909-73-0116
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...
ROS-20260909-73-0133
The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
ROS-20260909-73-0137
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
ROS-20260909-73-0173
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...
ROS-20260909-73-0073
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...
PT-2026-89201
Description A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical description This stored XSS appears because election question titles are...
CVE-2026-87485: Incorrect Authorization
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
Linux Distros Unpatched Vulnerability : CVE-2026-87622
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106776)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106776 advisory. GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote...
Important: python3.12-lxml security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Important: python-lxml security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
ROS-20260909-73-0021
The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
CVE-2026-85982
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
GHSA-6MJ3-QW4J-HGRW xmldom: HTML raw-text closing-tag case mismatch causes output amplification
Summary In HTML mode text/html, a raw-text element script, style, textarea, title whose closing tag differs in case from its opening tag e.g. for is mishandled by the parser, producing quadratic On² output growth — a small crafted document parses and serializes into output orders of magnitude...
EUVD-2026-69227
xmldom: HTML raw-text closing-tag case mismatch causes output amplification...
CVE-2026-85630
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...
DEBIAN-CVE-2026-85630
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...