Astra Linux – Vulnerability in Thunderbird, Firefox

Navigation was allowed when dragging a URL from a cross-origin iframe into the same tab, which could lead to website spoofing attacks. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...

Astra Linux – Vulnerability in Firefox, Thunderbird

Using tables within an iframe, an attacker could cause the iframe contents to be rendered outside the boundaries of the iframe, leading to potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox

It was possible to move the cursor using the pointer lock feature from an iframe. This allowed the cursor to be moved outside of the viewport and beyond the Firefox window. This vulnerability affects Firefox versions less than 128 and Thunderbird versions less than 128...

Debian dsa-6463 : gir1.2-javascriptcoregtk-4.1 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6463 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6463-1 [email protected] https://www.debian.org/securit...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409

WPForms Pro for WordPress (all versions ≤ 2.0.0.2 ) is vulnerable to unauthenticated Stored XSS via Single Line Text and Paragraph Text Field values. The root cause is the plugin's own wp_kses_allowed_html filter, which widens the 'post' allowlist to permit iframe elements with a data-src attribu...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

SUSE CVE-2026-64728

A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...

PT-2026-79293

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-64728

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

Linux Distros Unpatched Vulnerability : CVE-2026-64728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS...

PT-2026-79374

Name of the Vulnerable Software and Affected Versions PassPortal browser extension versions prior to 3.49.6 Description An unvalidated postMessage vulnerability in the PassPortal browser extension allows for authentication abuse. This flaw enables any website or iframe viewed by a user to obtain...

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

CVE-2026-65904

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

BIT-DISCOURSE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0...

BIT-DISCOURSE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...

PT-2026-73247

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.format for email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...