CVE-2026-95303: Incomplete Cleanup

Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102366: Unrestricted Upload of File with Dangerous Type

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

PT-2026-102845

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.92 Description A UI misrepresentation in the Omnibox allows a remote attacker to spoof the address bar by using a crafted HTML page. Recommendations Update to version 154.0.8037.92 or later...

Fedora 43 : perl-HTML-FormFu (2026-219b6aef6c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-219b6aef6c advisory. HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. In this...

PT-2026-102554

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 115.42 Firefox ESR versions prior to 140.17 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the DOM: Core & HTML...

CVE-2026-102366 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

CVE-2026-102366 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

GHSA-F67J-2JQW-JPQ7 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

GHSA-J3R3-MXQP-R2P4 Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

CVE-2026-101111

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

CVE-2026-101111

The Joomla Extension - ordasoft.com - Book Library (Free) version

wiki-xss-test

Test Security Repo alert'...

CVE-2026-100694

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-82326

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-82326

The Enocta Platform by Enocta Educational Technologies Inc. is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the vulnerability allows for XSS targeting HTML attributes . The impact is categorized as LOW for integr...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

EUVD-2026-88240

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...