PT-2026-77320

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An inappropriate implementation of Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote...

OPENSUSE-SU-2026:11540-1 python313-pytest-html-4.2.0-5.1 on GA media

These are all security issues fixed in the python313-pytest-html-4.2.0-5.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-74944: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

Linux Distros Unpatched Vulnerability : CVE-2026-75006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or...

CVE-2026-74944: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

PT-2026-77332

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A use after free issue exists in WebGL, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to visit a specially crafted HTML page. Use...

PT-2026-77135

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first name field of...

PT-2026-77322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An inappropriate implementation in the Media component of Google Chrome on Mac allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by inducing the...

PT-2026-77334

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary...

CVE-2026-75872: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

PT-2026-76977

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A use-after-free issu...

PT-2026-76931

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15 Description Stored cross-site scripting occurs during the rendering of audio and video media via the sourceParsedownElement function. The issue arises because the media URL fragment is concatenated without being...

PT-2026-76912

Name of the Vulnerable Software and Affected Versions SpiderFoot affected versions not specified Description The software fails to HTML-escape correlation titles generated from external scan data sources, such as server banners and metadata. This allows attackers to inject malicious HTML elements...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4837 more potentially affected by CVE-2026-63670 via sanitize-html (>=0.1.4, <=2.17.5)

sanitize-html NPM version =0.1.4, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =0.1.0, =0.1.0, =11.1.0, =1.3.0, =1.3.6 and more Source cves: CVE-2026-63670 Source advisory: MEND:CVE-2026-63670...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...