119735 matches found
DEBIAN-CVE-2026-85042
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85044
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-85048
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85051
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85053
A flaw was found in Google Chrome's CacheStorage component. This improper resource exposure vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a compromise of the user's system...
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2137 more potentially affected by CVE-2026-40186 +1 more via sanitize-html (>=2.1.0, <=2.17.5)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-40186, CVE-2026-63670 Source advisory: OSV:GHSA-JXWJ-J7WR-GFRW...
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2137 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-63670 Source advisory: GHSA-JXWJ-J7WR-GFRW...
GHSA-JXWJ-J7WR-GFRW ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....
EUVD-2026-60440
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...
CVE-2026-85044
An use of released resource flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517482830...
CVE-2026-85045
A race condition flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=547819997...
CVE-2026-85047
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-70711
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85049
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85044
Google Chrome on Android prior to version 152.0.7977.82 is vulnerable to a use of released resource in Mobile . A remote attacker could leverage social engineering to bypass the web origin policy by hosting a crafted HTML page. This vulnerability has a Medium security severity and was addressed i...
CVE-2026-85044
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...