119735 matches found
CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...
CVE-2026-77818
CVE-2026-77818 is a reflected HTML injection vulnerability in Yordam Informatics' Library Information and Document Automation Program (affects versions from v22.1 before v22.2 ), exploitable via form hijacking during web page generation. The vulnerability allows content spoofing and is rated CVSS...
vulnerabilities present in Google Chrome
Google has identified several vulnerabilities in Google Chrome, particularly in versions for 152.0.7977.82. These vulnerabilities reside in various components of Google Chrome, including DevTools, Network, V8 JavaScript engine, and Transactions Platform on iOS. Attackers can exploit these...
CVE-2026-85601
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
CVE-2026-85599
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...
RLSA-2026:63022 Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...
RLSA-2026:63136 Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive...
CVE-2026-85601
Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...
CLSA-2026-1788517172 TuxCare security update for sanitize-html (1 CVE)
TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.5...
GHSA-Q9QV-6QX8-79CG vulnerabilities
Vulnerabilities for packages: chromium...
Malicious code in dagda-non-blocking-html-webpack-plugin-astrophysics (npm)
Source: amazon-inspector a8c96a0cb89808b6a9d97752e052ed1ed344076a7cfc56315ad0186b572be54f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in cygnus-html-webpack-plugin-convict-sagitta (npm)
Source: amazon-inspector 77a7c905e6d297a266e003ada74f2dd7959d66a6bba0eb74d4c082c443e0fdd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in csrf-html-webpack-plugin-postgres-webdriver-manager (npm)
Source: amazon-inspector 0af2b65af5d61317084f768e05e83372d68c492ba3973262f0486b6fd8717364 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in csrf-bootes-html-webpack-plugin-ichnology (npm)
Source: amazon-inspector 42e683c14d1e59c58cadcd514400f46ff49670101cb068cc2ecf1d95b413dcf9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in cross-env-html-webpack-plugin-writable-dactyl (npm)
The package cross-env-html-webpack-plugin-writable-dactyl was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-80180
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
Malicious code in concurrently-hexo-weywot-html-webpack-plugin (npm)
Source: amazon-inspector 6bc8cda0f2eb6119ce7dccfd4014dedc2aeb7d4453e9ef894324d158b657e121 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in commitlint-mutation-tectonic-html-webpack-plugin (npm)
The package commitlint-mutation-tectonic-html-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in commitizen-less-loader-mysql-html-webpack-plugin (npm)
Source: amazon-inspector d1b0ecbb57fc6d6f24d993aca7226c40313a8afa4b924e0eff9c1058e3b64581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...