EUVD-2026-91716

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103631

A buffer overflow vulnerability in the WebRTC component of Google Chrome (prior to version 154.0.8037.97 ) allows a remote attacker to execute arbitrary code inside the browser's sandbox. The attack is initiated by enticing a user to visit a specially crafted HTML page . While the execution is re...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

unwaf

Unwaf Unwaf — это инструмент на Go, предназначенный для выявления обходов WAF с использованием пассивных техник. Он автоматизирует процесс поиска реального исходного IP-адреса за WAF/CDN, комбинируя несколько методов обнаружения и проверяя кандидатов путём сравнения схожести HTML, фингерпринтинга...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload — это набор инструментов для HTML -смугглинга, предназначенный для генерации HTML -страниц, которые встраивают и восстанавливают файлы с помощью JavaScript. Он предоставляет несколько методов HTML -смугглинга, параметры кодирования полезной нагрузки, вариации...

CVE-2026-104413

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Скриншот Быстрый, простой сканер для обнаружения CVE-2025-66470 - XSS-уязвимости в компоненте ui.interactiveimage фреймворка NiceGUI. 🔍 Детали уязвимости Поле| Значение ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Компонент| ui.interactiveimage...

EUVD-2026-91481

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML th...

CVE-2026-104470

Versions of YesWiki before 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Bazar valeur action . This flaw allows authenticated page editors to force the server to fetch arbitrary URLs by providing them via the url parameter . By embedding this action with a ...

CVE-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

EUVD-2026-91424

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2020-11022

Donc voilà Donc voilà les gars, CVE-2020-11022 est une vulnérabilité dans jQuery pour les versions inférieures à 3.5.0, cette vulnérabilité CVE-2020-11022 déclenche un XSS en exploitant la manipulation du DOM comme par exemple .html, .append, etc., pour exécuter du code XSS malveillant. 1...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 быстрая проверка import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text или POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

sunsetscan

SunsetScan Network security auditing for humans — powered by nmap, built for everyone. Website: sunsetscan.com SunsetScan is a local-network security auditing tool for home network owners and IT staff who want the depth of nmap without learning nmap syntax. Point it at your network and it finds...