CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103631

A buffer overflow vulnerability in the WebRTC component of Google Chrome (prior to version 154.0.8037.97 ) allows a remote attacker to execute arbitrary code inside the browser's sandbox. The attack is initiated by enticing a user to visit a specially crafted HTML page . While the execution is re...

EUVD-2026-91716

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

unwaf

Unwaf Unwafは、パッシブテクニック を用いてWAFバイパスの特定を支援するために設計されたGoツールです。複数の発見手法を組み合わせ、HTML類似度比較、SSL証明書フィンガープリント、HTTPヘッダー分析を通じて候補を検証することで、WAF/CDN背後にある実際のオリジンIPを発見するプロセスを自動化します。 Unwafは、こちらのLinkedIn投稿で説明した手順を自動化するものです: Passive WAF bypassing 現在のバージョン: 3.0.0 — バージョン履歴についてはCHANGELOG.mdを参照してください。 目次 仕組み 発見手法 検証手法...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayloadは、JavaScriptを使用してファイルを埋め込み再構築するHTML ページを生成するためのHTML スマグリングツールキットです。複数のHTML スマグリング手法、ペイロードエンコードオプション、JavaScriptのバリエーション、およびいくつかの組み込みHTML テンプレートを提供します。 機能 複数のHTML スマグリング手法 複数のHTML テンプレート Base64ペイロードエンコード ペイロードのチャンク分割 JavaScriptベースのファイル再構築 JavaScript文字列の難読化...

CVE-2026-104413

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 스크린샷 NiceGUI의 ui.interactiveimage 컴포넌트의 XSS 취약점인 CVE-2025-66470 을 탐지하는 빠르고 간단한 스캐너입니다. 🔍 취약점 세부 정보 필드| 값 ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 컴포넌트| ui.interactiveimage 영향받는 버전| NiceGUI ≤ 3.3.1 수정된 버전| NiceGUI 3.4.0+ 유형| Stored/Reflected XSS ...

CVE-2026-104470

Versions of YesWiki before 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Bazar valeur action . This flaw allows authenticated page editors to force the server to fetch arbitrary URLs by providing them via the url parameter . By embedding this action with a ...

EUVD-2026-91481

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML th...

CVE-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

EUVD-2026-91424

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2020-11022

Jadi gini jadi gini gais, CVE-2020-11022 itu kan kerentanan pada jquery yang di bawah versi 3.5.0 atau keatas, kerentanan CVE-2020-11022 itu sendiri yaitu memicu sebuah XSS dengan memanfaatkan DOM Manipulation seperti i.e. .html, .append, dan lainnya, untuk melakukan eksekusi kode XSS berbahaya. ...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 クイックテスト import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text または POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000 Content-Typ...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...