UBUNTU-CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-19873

The HTML::FormFu Perl module (versions through 2.08 ) is vulnerable to a resource exhaustion attack (Denial of Service) due to an unbounded repeat count in Repeatable elements. When counter_name is set, the process() method reads a count from the query string and deep-clones the child subtree for...

EUVD-2026-68458

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-19873 HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-19873 HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

ROOT-APP-NPM-CVE-2021-23424 CVE-2021-23424 in ansi-html - Patched by Root

Root has patched CVE-2021-23424 in the ansi-html package for Root:npm. Multiple fixed versions available...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

CVE-2026-81852

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EEF-CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Summary Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and...

CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...

EUVD-2026-68326

Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...

CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge browsers allows a hacker to trigger a service failure.

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Payments component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Payments component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

The vulnerability of Google Lens components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of Google Lens components in Google Chrome and Microsoft Edge browsers is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially created HTML page...

The vulnerability of the IndexedDB component in Google Chrome and Microsoft Edge web browsers allows a hacker to compromise data integrity.

The vulnerability of IndexedDB in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to manipulate data integrity through a specially created HTML page...