116537 matches found
EUVD-2026-62369
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
BIT-PYTHON-MIN-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data...
BIT-PYTHON-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data...
BIT-GOLANG-2026-56858 Fix Javascript regexp context tracking in html/template
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
BIT-LIBPYTHON-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data...
CVE-2026-76035
A flaw was found in Media in Google Chrome. This inappropriate implementation allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a compromise of the affected syste...
OPENSUSE-SU-2026:21592-1 Security update for go1.25
This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...
CVE-2026-19055
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...
CVE-2026-19056
The ProSolution WP Client WordPress plugin (versions before 2.0.11 ) is vulnerable to reflected Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages. An atta...
CVE-2026-19055
The ProSolution WP Client WordPress plugin, in versions prior to 2.0.11 , is vulnerable to reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape several parameters before they are reflected into HTML attributes on the plugin's public pages. This vuln...
CVE-2026-19055 ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...
CVE-2026-19055 ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...
EUVD-2026-62287
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...
EUVD-2026-62286
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...
CVE-2026-15253
The Easy Media Replace WordPress plugin (versions
PT-2026-78794
Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A stored Cross-Site Scripting XSS issue exists where a user with the "Incident Commander" role can store JavaScript within a note. This occurs because the system may treat note content as Hyperte...
CVE-2026-55090: Improper Neutralization of Input During Web Page Generation
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...
CVE-2026-18371: Improper Neutralization of Input During Web Page Generation
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
PT-2026-78712
Name of the Vulnerable Software and Affected Versions LiquidJS versions 10.26.0 through 10.27.0 Description The strip html filter in src/filters/html.ts can enter an infinite loop when processing an input string that contains a character. This occurs because the search for the next opener advance...
Linux Distros Unpatched Vulnerability : CVE-2026-76039
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain...