CLEANSTART-2024-RH11272 When an extension with the proxy permission registered to receive <all_urls>, the proxy

CVE-2020-35111 affects multiple packages. When an extension with the proxy permission registered to receive , the proxy. See references for individual vulnerability details...

CLEANSTART-2024-BO49867 Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

CVE-2021-23960 affects multiple packages. Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. See references for individual vulnerability details...

CLEANSTART-2024-AG56960 malicious extension could have opened a popup window lacking an address bar

CVE-2021-23984 affects multiple packages. A malicious extension could have opened a popup window lacking an address bar. See references for individual vulnerability details...

CLEANSTART-2024-UF67124 By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in th...

CVE-2021-38508 affects multiple packages. By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permissio...

CLEANSTART-2024-SO02742 Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL

CVE-2021-43536 affects multiple packages. Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. See references for individual vulnerability details...

CLEANSTART-2024-WG09544 Applying a CSS filter effect could have accessed out of bounds memory

CVE-2022-22738 affects multiple packages. Applying a CSS filter effect could have accessed out of bounds memory. See references for individual vulnerability details...

CLEANSTART-2024-VT87384 Due to a layout change, iframe contents could have been rendered outside of its border

CVE-2022-28286 affects multiple packages. Due to a layout change, iframe contents could have been rendered outside of its border. See references for individual vulnerability details...

CLEANSTART-2024-RR43913 By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed p...

CVE-2022-28282 affects multiple packages. By using a link with rel="localization" a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. See references for...

CLEANSTART-2024-AD64332 improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present

CVE-2022-29911 affects multiple packages. An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. See references for individual vulnerability details...

CLEANSTART-2024-XD03246 When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks

CVE-2022-31738 affects multiple packages. When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. See references for individual vulnerability details...

CLEANSTART-2025-BK96122 maliciously crafted URL to a Django (1

CVE-2017-7234 affects multiple packages. A maliciously crafted URL to a Django 1. See references for individual vulnerability details...

CLEANSTART-2026-QI80412 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

CVE-2026-27142 affects multiple packages. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. See references for individual vulnerability details...

CLEANSTART-2026-MY83521 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

CVE-2026-27137 affects multiple packages. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint wil...

CLEANSTART-2026-NV05870 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-NZ04755 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-KY52576 Netty is a network application framework for development of protocol servers and clients

CVE-2026-56746 affects multiple packages. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...

CLEANSTART-2026-GW34771 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-PT81625 Netty is a network application framework for development of protocol servers and clients

CVE-2026-45674 affects multiple packages. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...

CLEANSTART-2024-XB10248 Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash

CVE-2020-12406 affects multiple packages. Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. See references for individual vulnerability details...

CLEANSTART-2026-HD34144 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...