PT-2026-88950

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87477: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87653: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

ROS-20260909-73-0085

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260909-73-0036

The vulnerability of the WebGL component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260909-73-0109

The vulnerability of the Input component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-87437: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-87550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a...

Linux Distros Unpatched Vulnerability : CVE-2026-87548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML...

PT-2026-89124

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

ROS-20260909-73-0180

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0115

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260909-73-0179

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2026-87468: Incorrect Authorization

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-71803

The money-pos 1.0 software is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the backend fails to filter or escape the goodsName parameter during return processing, concatenating it directly into the order log description. The frontend then renders this co...

ROS-20260909-73-0139

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0119

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-87473: Incorrect Authorization

Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87569: Missing Authorization

Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: High...

CVE-2026-87620: Observable Discrepancy

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...