13782 matches found
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data and influence the integrity of the data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the lack of protective measures for the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a special...
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...
CVE-2026-82868: Improper Neutralization of Input During Web Page Generation
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82838: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82880: Improper Restriction of XML External Entity Reference
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
PT-2026-83784
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
PT-2026-83718
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
Malicious Package
Overview @lucideproxy/svg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @lucideproxy/svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c00e810f5961798d82a45678ccddfa58f15503ed24c6cad677a6ee854d86d7fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15600 Malicious code in @lucideproxy/svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c00e810f5961798d82a45678ccddfa58f15503ed24c6cad677a6ee854d86d7fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Unity Linux 20.1070e Security Update: python-lxml (UTSA-2026-104952)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104952 advisory. lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can ...
EUVD-2026-42996
Snipe-IT vulnerable to stored XSS via inline-served attachment...
Snipe-IT vulnerable to stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...
Chromium: CVE-2026-79016 Observable discrepancy in SVG
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability
Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...
openSUSE 16: libQt6Svg6 / libQt6SvgWidgets6 / qt6-svg-devel / etc (openSUSE-SU-2026:21626-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21626-1 advisory. This update for qt6-svg fixes the following issue: - CVE-2025-10729: use-after-free when processing pattern group nodes bsc1250994. Tenable has extracte...
Autodesk 3ds Max 2026.x < 2026.3.4 / 2027.x < 2027.2.0 Multiple Vulnerabilities (ADSK-SA-2026-0014)
The version of Autodesk 3ds Max installed on the remote Windows host is 2026.x prior to 2026.3.4, or 2027.x prior to 2027.2.0. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerabilit...
CVE-2026-49825
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...