99595 matches found
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2064 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-63670 Source advisory: OSV:GHSA-JXWJ-J7WR-GFRW...
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....
EUVD-2026-60440
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...
CVE-2026-85044
A flaw was found in Google Chrome on Android. This vulnerability involves the improper use of a released resource, which could allow a remote attacker to bypass the web origin policy. The web origin policy is a security mechanism that prevents malicious websites from interacting with legitimate...
CVE-2026-85045
A flaw was found in V8, the JavaScript engine used in Chromium-based browsers. This race condition vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox environment. Exploitation occurs when a user visits a specially crafted HTML page, potentially leading t...
EUVD-2026-70711
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85049
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85044
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-85049
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85044
CVE-2026-85044 is a use of released resource flaw in the Mobile component of Google Chrome on Android (versions prior to 152.0.7977.82 ). A remote attacker, leveraging social engineering and a crafted HTML page, can bypass the web origin policy , allowing unauthorized cross-site interaction with ...
CVE-2026-85049
A use after free vulnerability in the Skia component of Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the sandbox by serving a crafted HTML page. The CVSS 3.1 score is 8.8 (High) , reflecting a network vector with low complexity, no privileges requ...
EUVD-2026-70709
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85053
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85053
CVE-2026-85053 is an improper resource exposure vulnerability in the CacheStorage component of Google Chrome prior to 152.0.7977.82 . A remote attacker can execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page , per Chromium's assessment. The flaw carri...
CVE-2026-85042
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-70707
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-70706
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85042
A use-after-free vulnerability in DevTools within Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code outside the sandbox by serving a crafted HTML page. Chromium rates this as High severity; CVSS 3.1 scores it 9.6 (Critical) with a Changed Scope, reflecting sa...