CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2022-44311

Описание для CVE-2022-44311 html2xhtml v1.3 был обнаружен содержащий чтение за пределами выделенной памяти в функции static void elmclosetreenodet nodo в procesador.c. Эта уязвимость позволяет злоумышленникам получать доступ к конфиденциальным файлам или вызывать отказ в обслуживании DoS с помощь...

CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

cve-disclosures

Раскрытие CVE — Aman Bahiniya Три CVE, присвоенные MITRE в декабре 2024 года. Записи были зарезервированы, но так и не опубликованы, поэтому пока ничего не проиндексировано. Этот репозиторий публикует бюллетени, чтобы CVE стали доступны для поиска и получили авторство. CVE| Продукт| Тип ---|---|-...

DEBIAN-CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-91716

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103631

A buffer overflow vulnerability in the WebRTC component of Google Chrome (prior to version 154.0.8037.97 ) allows a remote attacker to execute arbitrary code inside the browser's sandbox. The attack is initiated by enticing a user to visit a specially crafted HTML page . While the execution is re...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

unwaf

Unwaf Unwaf — это инструмент на Go, предназначенный для выявления обходов WAF с использованием пассивных техник. Он автоматизирует процесс поиска реального исходного IP-адреса за WAF/CDN, комбинируя несколько методов обнаружения и проверяя кандидатов путём сравнения схожести HTML, фингерпринтинга...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload — это набор инструментов для HTML -смугглинга, предназначенный для генерации HTML -страниц, которые встраивают и восстанавливают файлы с помощью JavaScript. Он предоставляет несколько методов HTML -смугглинга, параметры кодирования полезной нагрузки, вариации...

CVE-2026-104413

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Скриншот Быстрый, простой сканер для обнаружения CVE-2025-66470 - XSS-уязвимости в компоненте ui.interactiveimage фреймворка NiceGUI. 🔍 Детали уязвимости Поле| Значение ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Компонент| ui.interactiveimage...