3831 matches found
CVE-2026-32600 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag,...
PT-2026-38097
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description An out of bounds read exists in Fonts, which allows a remote attacker to perform an out of bounds memory read by using a crafted HTML page. An out of bounds read occurs when a program...
Google Chrome ē¼å²åŗéčÆÆę¼ę“
Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 146.0.7680.75 contained a buffer overflow vulnerability. This vulnerability stemmed from out-of-bounds writes in Skia, which could allow remote attackers to execute out-of-bounds memory access via a special...
CVE-2026-32251 Tolgee has an XXE Injection in Translation Import
Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources .xml and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files...
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component...
DEBIAN-CVE-2026-3942
Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
CVE-2026-3942
The CVE-2026-3942 issue is a Chrome/Chromium vulnerability where the PictureInPicture security UI could be spoofed by a crafted HTML page. Affected product: Google Chrome/Chromium (Chromium-based browser). Root cause: incorrect security UI in PictureInPicture prior to version 146.0.7680.71. Impac...
CVE-2026-3941
Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
CVE-2026-3922
CVE-2026-3922 is a confirmed vulnerability in Google Chrome/Chromium involving a use-after-free in the MediaStream path. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with the impact described as high. Affected product/version details present i...
openSUSE 15 Security Update : python-Markdown (SUSE-SU-2026:0846-1)
The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0846-1 advisory. This update for python-Markdown fixes the following issue: - CVE-2025-69534: incomplete markup declaration in raw HTML can crash applications that process...
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component...
PT-2026-24861
Google releases Chrome 146, fixing 29 vulnerabilities including a critical heap buffer overflow in WebML CVE-2026-3913. Update your browser immediately. Chrome146 GoogleChrome CVE20263913 CyberSecurity PatchAlert InfoSec BugBounty Vulnerability https://t.co/Xywvdo0ywP https://t.co/eSaiAchpsb...
PT-2026-24880
šØ CVE-2026-3932 Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium š@cveNotify...
Appsmith å®å Øę¼ę“
Appsmith is an open-source platform developed by Appsmith itself, used for building, deploying, and maintaining internal applications. Prior to version 1.96, there were security vulnerabilities in Appsmith. These vulnerabilities stemmed from the lack of HTML cleaning in the Table Widget rendering...
PT-2026-24865
š CVE-2026-3917 - High Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High https://t.co/o0ZCRciQYq https://t.co/pa2QzEaBel...
PT-2026-24477
Name of the Vulnerable Software and Affected Versions Sylius versions 1.9.12 through 2.2.3 Description Sylius, an Open Source eCommerce Framework on Symfony, contains an authenticated stored cross-site scripting XSS issue in multiple areas of the shop frontend and admin panel. This is due to...
PT-2026-24877
CVE-2026-3929 Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. ā¦ https://t.co/Eu1lU8NeVv...
CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...
firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: HTML Parser component...
firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: HTML Parser component...