GHSA-M7RR-C95C-R68R vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-9921 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-9943 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-H44X-G8CV-P3QX vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3GGW-GM74-WQQP vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7V44-Q3V7-22WM vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-8RPV-XX2V-W955 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-9929 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-9938 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-9954 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-X7FM-CX6H-8JQR vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-V4C4-Q9W7-M653 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-33618

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray method uses PHP's eval to parse platform settings from the database. An attacker with admin access obtainable via Advisory 1 can inject arbitrary PHP code into the settings,...

CVE-2026-33583

Exposure of the QKEY used as input into the ‘OTA-Quantum’ device registration process and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03...

CVE-2026-42612

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting XSS vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss function when handling unquoted HTML event attribute...

CVE-2026-42611

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged with the ability to create a page user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visit...

CVE-2026-24467

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0.0 and prior to version 2.0.13, OpenAEV's password reset implementation contains multiple security weaknesses that together allow reliable...

CVE-2026-46408

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cartid and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another...

CVE-2026-40911

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the msg or callback fields. On the client side, plugin/YPTSocket/script.js contains two eval...

CVE-2026-40882

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to...