7759 matches found
GHSA-6WMF-3R64-VCWV Crass : Large numeric exponents cause CPU and memory denial of service
Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...
Crass : Large numeric exponents cause CPU and memory denial of service
Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...
Malicious code in tailwind-css-keyframes (npm)
tailwind-css-keyframes 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by kinsleybadu on 2026-09-28. src/motion.js:5 requires the private scoped package...
Malicious code in animate-twcss-bridge (npm)
animate-twcss-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package...
Malicious code in signalledger-diagnostics (npm)
signalledger-diagnostics 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...
Malicious code in animatecss-tailwind-helper (npm)
animatecss-tailwind-helper 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...
Malicious code in animatecss-tailwind-plugin (npm)
animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...
PT-2026-118694
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the CSS component, which could allow a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to open a specially...
Google Chrome Vulnerability: CVE-2026-112997
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
PT-2026-118748
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in CSS allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version 156.0.8078....
PT-2026-118769
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the CSS component, which may allow a remote attacker to execute arbitrary code outside the sandbox by inducing the user to open a specially crafted HTML page...
PT-2026-118900
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue in the CSS component allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page...
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 156 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 156.0.8078.47 Linux 156.0.8078.47/.48 Windows/Mac contains a number of fixes and improvements -- a list of changes is...
Google Chrome Vulnerability: CVE-2026-113203
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
Google Chrome Vulnerability: CVE-2026-113072
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
Google Chrome Vulnerability: CVE-2026-113051
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-112183
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...
CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...
CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...
