dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-94181

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181 Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

EUVD-2026-85565

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification...

CVE-2026-94181

Affected versions of the Arc browser are susceptible to an address bar spoofing issue. An attacker can spoof the browser address bar by utilizing a element that triggers requestFullscreen without displaying the standard fullscreen notification. Exploitation details are not provided in the docume...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

DRUPAL-CONTRIB-2026-159

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripti...

DRUPAL-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

PT-2026-97651

Name of the Vulnerable Software and Affected Versions Webform affected versions not specified Description The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting XSS, a technique where malicious scripts are injected into truste...

PT-2026-97650

Name of the Vulnerable Software and Affected Versions Drupal Contributed Module affected versions not specified Description The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting XSS, a technique where malicious scripts ar...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripti...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

PT-2026-97532

Name of the Vulnerable Software and Affected Versions Arc affected versions not specified Description An address bar spoofing issue exists where an attacker can manipulate the browser address bar. This is achieved using a element that triggers the requestFullscreen function without displaying the...

PT-2026-97151

Name of the Vulnerable Software and Affected Versions Fast FAC1203R Gigabit Edition version 2.0.4 Description A stack-based buffer overflow exists in the Device Discovery Service component. This issue occurs within the copy msg element function and can be triggered remotely through manipulation...

MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...

WordPress Element Pack Addons for Elementor plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...