ROS-20260911-73-0233

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0231

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0229

The vulnerability of the Glic component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0225

The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260911-73-0045

The vulnerability of the Serial component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-89858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

ROS-20260911-73-0034

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and also cause service interruptions through the...

CVE-2026-89243: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

ROS-20260911-73-0048

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to reading data from buffer areas beyond the acceptable limit. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0113

The vulnerability of the Actor component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-90498

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

ROS-20260911-73-0179

The vulnerability of the Payments component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0128

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0238

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260911-73-0129

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260911-73-0146

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0123

The vulnerability of the Ozone component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0147

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, as well as cause service failures through a specially created HTML page...

CVE-2026-89145: Improper Neutralization of Input During Web Page Generation

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89256: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...