116757 matches found
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...
PT-2026-82210
Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4 Description A DOM-based Cross-Site Scripting XSS issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM...
CVE-2026-75411
JeecgBoot v3.9.2 is vulnerable to Remote command execution via the CodeNode component of the AI Flow module. The component supports Groovy script execution , but the SecurityCheck class uses a blacklist mechanism that can be completely bypassed due to the dynamic nature of Groovy, specifically th...
PT-2026-82285
Name of the Vulnerable Software and Affected Versions Dell PowerProtect Cyber Recovery versions prior to 20.3 Description An issue exists where the software follows UNIX Symbolic Links Symlinks, which are files that point to another file or directory. A low privileged attacker with local access...
Linux Distros Unpatched Vulnerability : CVE-2026-79195
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...
CVE-2026-54606: Improper Neutralization of Input During Web Page Generation
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
PT-2026-82304
Name of the Vulnerable Software and Affected Versions JeecgBoot version 3.9.2 Description Remote command execution is possible in the CodeNode component of the AI Flow module, which supports Groovy script execution. The SecurityCheck class uses a blacklist to intercept dangerous calls; however,...
CVE-2026-79939: UNIX Symbolic Link (Symlink) Following
Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...
CVE-2026-75411: Improper Control of Generation of Code
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...
CVE-2026-38473
A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...
DEBIAN-CVE-2026-79195
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-79195
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-79195
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...
CVE-2026-79195
A use after free vulnerability in the Script component of Google Chrome (prior to version 152.0.7977.65) allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue also impacts Chromium-based browsers, including Microsoft Edge . Remediation includes ...
CVE-2026-79195
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-79195
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
