viber-desktop-html-injection

Viber Desktop — Inyección HTML CVE-2025-55996 CVE: CVE-2025-55996 Descubridor: Thaw Khant Cycbake Producto: Viber Desktop Afectado: Viber Desktop 25.6.0 y posiblemente versiones anteriores Resumen El manejador de enlaces profundos de Viber Desktop viber://forward?text= puede renderizar HTML sin...

Astra Linux – Vulnerability in Chromium

In versions of Google Chrome before 153.0.8010.36, improper representation of user interface elements allowed a remote attacker to exploit social engineering techniques to manipulate UI elements through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

CVE-2026-18058

The mobile Smart Connect dashboard UI (referenced via Motorola support, with CNA from Lenovo PSIRT ) was vulnerable to manipulation by third-party apps . When combined with a phishing attack , this manipulation could lead to privilege escalation for an attacker within the system. The vulnerabilit...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

PT-2026-84755

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

CVE-2026-18371 HTML injection in M-Files Web

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

GHSA-6X64-9X62-F2GX Mermaid allows CSS injection applying to sibling elements of the diagram

Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with mermaid-X, sibling and + combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram . Most users of mermaid would not be affected by this...

CVE-2026-57963

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

BIT-KIBANA-2026-42401 Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

EUVD-2026-33012

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401 Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401 Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401 Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

CVE-2026-42401

CVE-2026-42401 affects Kibana, where improper neutralization of input during web page generation (CWE-79) allows stored HTML injection. A user with write access to an Elasticsearch index can persist crafted markup that, when rendered in a Kibana view by another user, may not be sufficiently sanit...