115046 matches found
CVE-2026-88976: Improper Neutralization of Input During Web Page Generation
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs,...
Google Chrome has an authorization vulnerability (CNVD-2026-37834)
Google Chrome is a free web browser developed by Google Inc. Google Chrome has a vulnerability related to authorization issues, which stems from improper authorization in the Actor component. Attackers can exploit this vulnerability to obtain sensitive information through specially crafted HTML...
Moonshot AI Kimi 1.0 Cross Site Scripting
Moonshot AI Kimi version 1.0 contains a stored cross site scripting vulnerability in HTML artifact preview rendering and the public Share view. Model-generated HTML artifacts can execute JavaScript within the application's origin, allowing a crafted shared artifact to access session values stored...
CVE-2026-86444: Improper Neutralization of Input During Web Page Generation
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...
Google Chrome Authorization Issue Vulnerability
Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing issue vulnerability, which stems from improper licensing management in CORS. Attackers can exploit this vulnerability by using specially crafted HTML pages to bypass Web source policies...
CVE-2026-19619: Improper Neutralization of Input During Web Page Generation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...
PT-2026-93323
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper sanitization of pasted HTML content in the Content Editor could allow an unauthenticated user to...
CVE-2026-63671: Improper Neutralization of Input During Web Page Generation
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
Google Chrome Authorization Vulnerability (CNVD-2026-37842)
Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing issue vulnerability, which stems from improper licensing management in FedCM. Attackers can exploit this vulnerability by using specially crafted HTML pages to bypass Web source policies...
PT-2026-93300
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...
CVE-2026-19857: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...
PT-2026-94055
Name of the Vulnerable Software and Affected Versions CMAK versions prior to 3.0.0.7 Description The software fails to apply the scheduled leader election feature toggle to HTML form routes, which allows attackers to bypass the feature gate. By accessing these form endpoints, an attacker can star...
Google Chrome Authorization Vulnerability (CNVD-2026-37837)
Google Chrome is a free web browser developed by Google Inc. There is an authorization vulnerability in Google Chrome, which stems from incorrect DataTransfer authorization. Attackers can exploit this vulnerability to obtain sensitive information through specially crafted HTML pages...
GitLab 19.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-19619)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...
PT-2026-93760
Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.11 Plate versions 54.0.0-beta.0 through 54.0.0-beta.1 Description Core HTML deserialization APIs parse supplied HTML strings within the active document. When untrusted or cross-user HTML is passed to these APIs,...
CVE-2026-91714
An observable discrepancy flaw was found in the Fonts component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517710554...
SUSE CVE-2026-92018
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...
SUSE CVE-2026-92022
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...
SUSE CVE-2026-92028
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...