116301 matches found
PT-2026-81837
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A UI misrepresentation in Geometry allows a remote attacker to spoof UI elements by using a crafted HTML page. Recommendations Update to version 152.0.7977.65 or later...
PT-2026-81841
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in Forms allows a remote attacker to obtain sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to version...
PT-2026-81845
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in the CSS component that allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update...
CVE-2026-78891: Heap-based Buffer Overflow
Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
PT-2026-81282
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...
PT-2026-81745
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak in the Document Object Model DOM allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script load...
AZL-97956 CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...
DEBIAN-CVE-2026-76098
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...
CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...
CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...
CVE-2026-76098
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...
EUVD-2026-65090
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...
CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...
CVE-2026-78555
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...
OPENSUSE-SU-2026:21635-1 Security update for ImageMagick
This update for ImageMagick fixes the following issues: - CVE-2026-56365: memory leak in the PNG encoder when writing MNG images bsc1270004. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62363: heap buffer overwrite in fx...
JLSEC-2026-1387 A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
CVE-2026-76837
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...
CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...
EUVD-2026-65009
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...
CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...