New Tab Page Component DoS

The vulnerability of the New Tab Page component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Unity Linux 20.1070a Security Update: coreutils (UTSA-2026-104994)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104994 advisory. GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. Th...

Chromium: CVE-2026-79123 Improper input validation in NTP Footer

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-79123

A flaw was found in Google Chrome. Improper input validation in the New Tab Page NTP Footer allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This can be achieved by enticing a user to visit a crafted HTML page...

CVE-2026-75628

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

EUVD-2026-63189

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

PT-2026-78875

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same origin path accepts a backslash or tab in the return parameter. oauth2 login reads the return parameter from the initiation request, runs same origin path over it, and stores the survivo...

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. ImpactThis vulnerability allows for arbitrary...

CVE-2026-70747

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite component: Customer Tab. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

EUVD-2026-60930

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66646

The WordPress plugin WP Tab Widget (versions ≤ 1.2.11) contains a contributor-level stored XSS vulnerability: untrusted input is output without sanitization, allowing a contributor to inject scripts that execute in visitors' browsers. CVSS 3.1 scores 6.5 (Medium). CISA SSVC reports no known explo...

CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

CVE-2026-66646: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...