CVE-2026-88059

Angular's @angular/common HttpTransferCache can leak authenticated responses when Server-Side Rendering uses a hierarchical HttpClient with withRequestsMadeViaParent. The child TransferCache evaluates a request as anonymous before a parent interceptor injects credentials (Authorization header, co...

CVE-2026-23498

CVE-2026-23498: Shopware tiene un control inadecuado de la generación de código en las vistas renderizadas con Twig Descripción general...

CVE-2026-88056

Angular's @angular/platform-server is vulnerable to SSRF and cross-origin credential disclosure prior to versions 20.3.30, 21.2.22, and 22.1.4 . The root cause is that the resolveUrl and parseUrl utilities invoked String.prototype.trim(), which strips leading Unicode whitespace (e.g. U+00A0, U+FE...

CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...

PT-2026-89700

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-85630

A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...

CVE-2026-19855 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

CVE-2026-49314

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49314

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49314

CVE-2026-49314 is an out-of-bounds (OOB) write vulnerability in the rendering and composition module of a Huawei consumer product, as indicated by the vendor support bulletin references (including a laptop-specific bulletin). The vulnerability is rated CVSS 7.3 (HIGH) with a local attack vector r...

EUVD-2026-74596

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-87620

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Scalable Vector Graphics SVG rendering engine by enticing a user to open a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-87614

A flaw was found in ServiceWorker in Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker who has already compromised the browser's rendering engine to bypass the web origin policy. Bypassing this policy could enable unauthorized access to data o...

DEBIAN-CVE-2026-87620

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-71803

money-pos 1.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, concatenating it directly into the order log description, which the frontend renders using v-html . An attacker with product crea...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-19872

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...

CVE-2026-28666

CVE-2026-28666 affects Android (identified via ASB-A-501447778 and the 2026-09-01 Android Security Bulletin). The vulnerability resides in multiple functions of LocalImageResolver.java , where a DNG image rendering check bypass enables a Remote Persistent Denial of Service that can escalate to re...