118518 matches found
CVE-2026-91120
The open-source discussion platform Discourse contains a stored HTML injection vulnerability in its video notification email and chat summary generation. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 , provider-controlled video titles from lazy video embeds (YouTube, Vimeo, or TikT...
GHSA-6RF4-V2FH-M6P4 SunEditor: Critical XSS vulnerability - sanitizer bypass
Summary SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that execute...
SunEditor: Critical XSS vulnerability - sanitizer bypass
Summary SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that execute...
CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...
CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...
CVE-2026-56736
The open-source FAQ web application phpMyFAQ is vulnerable to a stored cross-site scripting (XSS) flaw in versions prior to 4.2.0-alpha . The root cause is an HTML entity bypass where the html_entity_decode() function converts entities into executable HTML after strip_tags() has already processed...
SUSE-SU-2026:23918-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.3.0 ESR MFSA 2026-93, bsc1280371: - CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. - CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in the Browser of Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper state validation in the installer of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after-free in V8 in Google Chrome before version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in USB settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The out-of-bounds reading in ANGLE in Google Chrome before 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The vulnerability allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page, using ANGLE in Google Chrome before version 152.0.7977.65. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 153.0.8010.36, using free after in the Chromecast with Google Chrome allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: Medium...