CVE-2026-66683

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2026-66683 WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2025-26240

A flaw was found in python-pdfkit. The fromstring method allows an attacker to execute JavaScript code within the server application's context. This can lead to the exfiltration of local files, potentially compromising sensitive information. Mitigation To reduce exposure, avoid processing untrust...

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom CSS and JavaScript versions = 2.0.16...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission.As of publication of...

SUSE CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

RLSA-2026:49921 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

RLSA-2026:49922 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

PT-2026-68743

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A TENANT ADMIN can store javascript: URLs within the tenant links configuration, specifically in the website, imprint, and privacyStatement variables. These values are returned to the...

PT-2026-68965

Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true which is the default value and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches Workarounds Set...

PT-2026-69021

Name of the Vulnerable Software and Affected Versions pdfjs-dist affected versions not specified Description When enableScripting is set to true and no Content Security Policy CSP is configured to disallow script-src, loading a malicious PDF can lead to the execution of unrestricted...

PT-2026-68809

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A stored cross-site scripting issue exists in the crawler domain view. The application embeds crawled URLs directly into a JavaScript onclick handler used to display stored screenshots...

CVE-2026-71439: Unchecked Input for Loop Condition

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...

CVE-2026-66843: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2026-48081: Improper Neutralization of Input During Web Page Generation

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...

RockyLinux 9 : thunderbird (RLSA-2026:49921)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49921 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...