CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3922

Google Chrome and Microsoft Edge browsers are affected by a use-after-free vulnerability in the MediaStream component. This flaw occurs when the software re-references or uses memory after it has been freed, which can be triggered by a remote attacker using a crafted HTML page . Exploitation of t...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component...

PT-2026-27279

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.165 Description A use-after-free issue exists in the WebGPU component of Google Chrome. This flaw could allow a remote attacker to execute arbitrary code within a sandbox through a specially crafted...

firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: HTML Parser component...

Django: Django: Denial of Service via crafted HTML inputs

A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the django.utils.text.Truncator.chars and Truncator.words methods when html=True, or through the truncatecharshtml and truncatewordshtml...

EUVD-2026-9490

Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

CVE-2026-3545

The Navigation component in Google Chrome and Microsoft Edge is vulnerable to a sandbox escape due to insufficient data validation . A remote attacker can exploit this flaw by providing a crafted HTML page . The vulnerability affects versions prior to 145.0.7632.159 . Remediation is available in ...

PT-2026-22974

Name of the Vulnerable Software and Affected Versions ClamAV versions prior to 1.5.2 ClamAV versions prior to 1.4.4 Description A flaw exists in the HTML Cascading Style Sheets CSS module of ClamAV that could allow a remote, unauthenticated attacker to cause a denial of service DoS condition. Thi...

WordPress plugin WooCommerce Photo Reviews 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

firefox: thunderbird: Undefined behavior in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the DOM: Core & HTML component...

CVE-2026-27746 SPIP jeux < 4.1.1 Reflected XSS via index Parameters

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting XSS vulnerability in the prepropre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages...

CVE-2026-2799

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox 148 and Thunderbird 148...

EUVD-2026-8452

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox 148...

CVE-2026-25797

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a...

CVE-2026-25797

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a...

Mozilla Firefox和Mozilla Thunderbird 安全漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the American Mozilla Foundation. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. This software supports IMAP and POP email...

Mozilla Firefox和Mozilla Thunderbird 安全漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the American Mozilla Foundation. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. This software supports IMAP and POP email...

CVE-2026-22422 WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through = 3.4.1...

CVE-2025-55853

SoftVision webPDF versions prior to 10.0.2 are vulnerable to Server-Side Request Forgery (SSRF) . The underlying cause is that the PDF converter function fails to validate internal or external resources requested within uploaded files, permitting protocols such as http:// and file:/// . An attack...