CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-91716

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Google Chrome versions prior to 154.0.8037.97 are vulnerable to an information leak within the SVG component. A remote attacker can exploit this vulnerability to obtain sensitive information by interacting with a crafted HTML page . The issue has been addressed in the 154.0.8037.97 release for Wi...

EUVD-2026-91713

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103622

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103622

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103622

A Use after free vulnerability in SVG affects Google Chrome versions prior to 154.0.8037.97 . This flaw allows a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page. Remediation is available in version 154.0.8037.97 for Windows and Mac, and 154.0.8037.97 for L...

CVE-2026-103622

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

VectorFreed

VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

CVE-2026-104461

YesWiki versions prior to 4.6.7 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Bazar FileField . The root cause is that the application validates only the file extension during upload and fails to call HtmlPurifierService::cleanFile, allowing SVG files to be stored ver...

EUVD-2026-91472

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE via SVG Image Upload Program Code Python Flask + XML parser xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST' def uploadsvg: svgdata = request.data...

CVE-2024-37383_PoC

This is a repository for hands-on practice of the CVE-2024-37383 vulnerability. Analysis Report: blog / pdf CVE-2024-37383 Detail Name : Roundcube Webmail SVG Parsing XSS Target : Roundcube Webmail v1.5.7 or v1.6.x tag into an email, arbitrary scripts are executed in the browser. Exploit git clon...

PT-2026-104387

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

Google Chrome < 154.0.8037.97 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop advisory. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a...