CVE-2026-83353: Improper Privilege Management

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter...

CVE-2026-92042: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

PT-2026-92875

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter...

CVE-2026-92257: Improper Neutralization of Input During Web Page Generation

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

PT-2026-92187

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web url read in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Leng...

CVE-2026-87289: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

CVE-2026-69217: Inconsistent Interpretation of HTTP Requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69205: Inconsistent Interpretation of HTTP Requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunke...

CVE-2026-91967: Server-Side Request Forgery (SSRF)

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

CVE-2026-55630: Improper Neutralization of Input During Web Page Generation

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...

CVE-2023-54397: Inconsistent Interpretation of HTTP Requests

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

PT-2026-92427

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description Ember's HTTP/1.1 parser accepts duplicate Content-Length headers with different values and utilizes the last value instead of rejecting the message. This behavior...

ROS-20260915-73-0083

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to manipulate data integrity through a specially created HTML page...

ROS-20260915-73-0094

The vulnerability of the Content Security Policy component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability allows an attacker to compromise data integrity through a specially crafted HTML page...

PT-2026-92377

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

PT-2026-91978

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Firefox ESR versions prior to 153.3 Thunderbird versions prior to 156 Thunderbird versions prior to 153.3 Description A race condition exists within the DOM: Content Processes component. A race condition is a...

PT-2026-92111

Name of the Vulnerable Software and Affected Versions Design Scuole Italia affected versions not specified Description Authorization bypass issues exist within the dsi pdf generator and dsi csv generator functions. These flaws allow an unauthenticated attacker to access restricted "Circolare"...

CVE-2026-90835

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2026-90835

A cross-site scripting (XSS) vulnerability exists in michaelliao itranswarp (up to version 2.19), specifically in the function Markdown.toHtml within Markdown.java under the Page Content Rendering component. The flaw allows a remote attacker to inject scripts via crafted page content. The exploit...

CVE-2026-90835 michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...