CVE-2026-54355: Improper Neutralization of Input During Web Page Generation

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

CVE-2026-93382: Use After Free

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93379: Incorrect Authorization

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93377: Access of Resource Using Incompatible Type

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-68523: Uncontrolled Resource Consumption

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...

CVE-2026-93383: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-95125

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description An information leak exists in the Permissions component that allows a remote attacker to leak cross-origin data by using a crafted HTML page. Cross-origin data leakage occurs when a...

PT-2026-94166

Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor versions prior to 3.2.6 Description Users with contributor-level access and above can store a crafted HTML tag name used to render section headlines in several widgets and blocks. Because the plugin does not restri...

PT-2026-94358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Improper escaping of bookmark labels imported from notebook files occurs during rendering in the dock tree. This allows attackers to create malicious .sy notebook files containing unescaped HTML withi...

PT-2026-95407

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 14.10.2 XWiki versions prior to 15.0 RC1 Description XWiki Rendering, a system that converts textual input from one syntax to another, fails to properly escape rendering output when it is included as content within HTML...

RockyLinux 8 : python-lxml (RLSA-2026:67943)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

Siemens Teamcenter 2412.x < 2412.0013 / 2506.x < 2506.0010 / 2512.x < 2512.2607 / 2606.x < 2606.2607 XSS (SSA-157465)

The version of Siemens Teamcenter installed on the remote host is 2412.x prior to 2412.0013, or 2506.x prior to 2506.0010, or 2512.x prior to 2512.2607, or 2606.x prior to 2606.2607. It is, therefore, affected by a reflected cross-site scripting vulnerability. Affected applications do not properl...

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

GHSA-MXM6-V9R6-R94C @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

CVE-2026-92814

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

EUVD-2026-81072

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

EUVD-2026-81041

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...