7061 matches found
CVE-2026-2441-PoC
CVE-2026-2441-PoC CVE-2026-2441 PoC Chrome CSS 释放后使用（Use-After-Free）PoC（Blink CSSFontFeatureValuesMap） 触发 CSS 处理中的 UAF → 在 Chrome =144.0.x（所有平台）的沙箱内实现渲染器 RCE 的 PoC。 触发方式： @font-feature-values + container-query + 通过 rAF 循环中的 offsetWidth 强制布局重算 → 迭代器失效，在 CSSValue 仍被引用时将其释放。 利用链摘要： CSSOM 布局（grooming...
CVE-2026-2441
Google Chrome CSS 远程代码执行漏洞（CVE-2026-2441） 概述 已识别出一个高危漏洞，编号为 CVE-2026-2441，归类于 CWE-416、CWE-416（CVSS 8.8）。在 Google Chrome 145.0.7632.75 之前版本中，CSS 存在释放后使用漏洞，允许远程攻击者通过精心构造的 HTML 页面在沙箱内执行任意代码。（Chromium 安全等级：高危） 详情 CVE 编号 ：CVE-2026-2441 发现日期 ：2026-02-13 发布日期 ：2026-02-13 影响范围 ：机密性、完整性、可用性 漏洞利用可用性...
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
SummaryBefore tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset, ...
CVE-2026-2441
CVE-2026-2441 — Chrome CSSFontFeatureValuesMap の Use-After-Free（解放後使用） CVSS 8.8（高） | 実環境で活発に悪用 | レンダラー RCE（サンドボックス化） Google Chrome の Blink CSS エンジンに存在する use-after-free（解放後使用）脆弱性です。リモートの攻撃者が、細工された HTML ページを介してブラウザのサンドボックス内で任意のコードを実行できる可能性があります。 脆弱性の詳細 項目| 値 ---|--- CVE| CVE-2026-2441 CVSS| 8.8（高）...
CVE-2020-13756-env
CVE-2020-13756 脆弱性テスト環境 CVE-2020-13756 （Sabberworm PHP CSS Parser リモートコード実行）の脆弱性テスト環境です。 脆弱性の詳細 フィールド| 値 ---|--- CVE| CVE-2020-13756 製品| Sabberworm PHP CSS Parser 影響を受けるバージョン| getSelectorsBySpecificity' ' . $GET'n'; // When n=100;printf"test"; the eval executes: eval' 100;printf"test";' 参考情報 NVD...
CVE-2026-14995
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
EUVD-2026-90560
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-14995
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.15.1 . The root cause is insufficient input sanitization and output escaping when handling the REQUEST_URI Path . An unauthenticated attacker can inject arbitrary web sc...
CVE-2024-58258
CVE‑2024‑58258 – SugarCRM SSRF & Local File Disclosure About This repository provides a proof‑of‑concept for CVE‑2024‑58258 , a SugarCRM 13.0.4 / 14.0.1 vulnerability where user input is parsed as LESS in the /css/preview API, allowing unauthenticated SSRF or local file access. Affected Versions...
AlmaLinux 9.6 [TuxCare] Security Update: yelp / yelp-devel / yelp-libs (ALMALINUX9.6:CLSA-2026:1784539549)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784539549 advisory. - A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak...
Linux Distros Unpatched Vulnerability : CVE-2026-100815
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox...
SUSE CVE-2026-100815
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
CVE-2024-42009-roundcube-xss
CVE-2024-42009 — Roundcube Webmail 1.6.6 保存型XSS PoC 認可されたセキュリティテスト、CTF環境、教育研究専用です。 このツールを、所有していない、または書面による許可を得ていないシステムに対して使用することは、英国のComputer Misuse Act 1990、米国のCFAA、および世界各国の同等の法律の下で違法となります。 脆弱性の概要 フィールド| 詳細 ---|--- CVE| CVE-2024-42009 影響を受けるソフトウェア| Roundcube Webmail ≤ 1.6.6 修正バージョン| 1.6.7 / 1.6....
DEBIAN-CVE-2026-100815
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
CVE-2026-100815
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
