CVE-2026-12054: Improper Neutralization of Input During Web Page Generation

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-109636

Name of the Vulnerable Software and Affected Versions @progress/kendo-react-charts versions 1.1.0 through 16.1.x Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileges who can...

CVE-2026-106313

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498770931...

CVE-2026-106274

An incorrect reference resolution flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497842821...

CVE-2026-106246

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514070956...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.14 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin FluentForm versions = 6.2.14...

EUVD-2026-95740

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1...

CVE-2026-94661

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10...

chromebackdoor

Puerta trasera del navegador Chrome VÍDEO Texto de instalación V 3.0 Video de instalación ANTIGUO Guía de Binder Guía de módulos Complementos de captura de formularios Complementos de MessengerSpy de Facebook Notificador de Jabber / Ocultar panel Infección en Windows Payload de Rubber Ducky...

Source

Repositorio Fuente de LibreWolf Este repositorio contiene todos los parches y temas que componen LibreWolf, así como scripts y un Makefile para compilar LibreWolf. También está el repositorio de Configuración, que contiene las preferencias de LibreWolf. Resumen de LibreWolf graph LR FFSRCFirefox...

user-agent-desktop

Este proyecto está descontinuado. Recomendamos usar Ghostery Tracker and Ad Blocker en Firefox. Navegador Privado Ghostery El Navegador de Escritorio Ghostery es un fork minimalista de Firefox optimizado para la privacidad. Las principales características adicionales son: La extensión Ghostery...

Stable Channel Update for ChromeOS / ChromeOS Flex

The Stable channel is being updated to OS version 16805.33.0 Browser version 154.0.8037.151 for most ChromeOS devices. If you find new issues, please let us know one of the following ways 1. File a bug 2. Visit our ChromeOS communities 1. General: Chromebook Help Community 2. Beta Specific:...

CVE-2026-84244

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting XSS in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated...

CVE-2026-107397

The event management system Indico is vulnerable to a Cross-Site Scripting (XSS) flaw in its minutes editor prior to version 3.3.13 . The root cause is that users with content creation privileges, such as speakers, can store crafted HTML within event minutes. When concurrent edits occur on the sa...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107396

The Indico event management system is vulnerable to Cross-Site Scripting (XSS) in versions prior to 3.3.13 . The flaw exists because users with permissions to manage events or create content (such as speakers uploading materials) can store crafted javascript URLs in fields that accept custom URLs...

EUVD-2026-95243

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting XSS in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated...

CVE-2026-84244 IBM Guardium Data Protection Cross-Site Scripting

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting XSS in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated...

CVE-2026-40804 WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0...

CVE-2026-107301

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...