Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the download feature that could allow a remote attacker to bypass download protection via a specially crafted HTML...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of WebRTC and could allow a remote attacker to arbitrarily read or write through specially crafted HTML pages...

firefox: thunderbird: Mitigation bypass in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Core & HTML component...

CVE-2025-66423

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

Cross-site Scripting (XSS)

mailgen is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization in the generatePlaintext method, which fails to remove HTML tags provided as encoded entities, allowing an attacker to inject malicious HTML or JavaScript that can execute when the resulting...

Google Chrome Compositing UI Replacement

The vulnerability of Google Chrome’s Compositing component is related to errors in information representation by the user interface. Exploiting this vulnerability can allow an attacker to replace the user interface with a specially created HTML page...

CVE-2024-32384

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device...

Google Chrome V8 Engine Use-After-Free

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially created HTML page...

Tryton sao allows XSS via an HTML attachment

Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...

UBUNTU-CVE-2025-66420

Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...

CVE-2025-13742 Limited HTML injection in emails

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML i...

CVE-2025-64333

A flaw was found in Suricata. This vulnerability allows a stack overflow, leading to a crash, via a large HTTP Hypertext Transfer Protocol content type when logged...

CVE-2025-64331

A flaw was found in Suricata. This vulnerability allows a stack overflow, leading to a denial of service DoS, via large HTTP Hypertext Transfer Protocol file transfers when the HTTP Hypertext Transfer Protocol response body limit is increased and logging of printable HTTP Hypertext Transfer...

PT-2025-48235

The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

PT-2025-48380

Name of the Vulnerable Software and Affected Versions Tryton versions prior to 6.0.70 Tryton versions prior to 7.0.40 Tryton versions prior to 7.4.21 Tryton versions prior to 7.6.11 Description The software does not enforce access rights for the route of the HTML editor. Recommendations Update to...

CVE-2025-64331

Suricata (OISF) prior to 7.0.13 and 8.0.2 is affected by a stack overflow when handling large HTTP file transfers if the HTTP response body limit is increased and printable HTTP bodies are logged. The issue has been patched in versions 7.0.13 and 8.0.2. Practical mitigation steps include upgradin...

Suricata security vulnerabilities

Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata versions prior to 7.0.13 and prior to 8.0.2, which stems from a stack overflow during large HTTP file transfers that could lead to a crash...

Oracle Identity Manager REST WebServices DoS

The vulnerability of the REST WebServices component of the Oracle Identity Manager identity management software from Oracle Fusion Middleware is related to the lack of authentication checks for a critical function. Exploiting this vulnerability could allow an attacker to cause service failures...

EUVD-2025-199588

Security Point Windows of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege...

WordPress HT Mega plugin cross-site scripting vulnerability

WordPress HT Mega plugin is an Elementor page builder plugin designed for WordPress websites. The WordPress HT Mega plugin suffers from a cross-site scripting vulnerability that stems from insufficient validation of user-supplied HTML tag name input, which can be exploited by an attacker to execu...