CVE-2026-81807

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-77792

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

wget security, bug fix, and enhancement update

An update is available for wget. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, a...

RLSA-2026:62144 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory corruption via crafted Metalink URL CVE-2026-58469 wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471...

wget security, bug fix, and enhancement update

An update is available for wget. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, a...

CVE-2026-81807

CVE-2026-81807 affects the Simple Ajax Chat WordPress plugin prior to version 20260827 . The root cause is that chat message content is not properly escaped during the linkification process before rendering, resulting in an unauthenticated stored XSS . An attacker can inject arbitrary HTML attrib...

EUVD-2026-69859

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-77792 RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

EUVD-2026-69843

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

CVE-2026-77792

The RegistrationMagic WordPress plugin before 6.0.9.9 contains an unauthenticated Stored Cross-Site Scripting vulnerability. A registration form field value (specifically the Rating field) is not escaped before being output in an HTML attribute on an administrative page, allowing an unauthenticat...

SUSE CVE-2026-83612

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

SUSE CVE-2026-84125

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

SUSE CVE-2026-84137

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

EUVD-2026-69731

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-69743

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-69745

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-69740

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-69744

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...