authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

authcov

AuthCov Escaneo de cobertura de autorización de aplicaciones web. Introducción AuthCov rastrea su aplicación web utilizando un navegador Chrome sin interfaz gráfica mientras está conectado como un usuario predefinido. Intercepta y registra las solicitudes API, así como las páginas cargadas durant...

LinkedInt

Patrocina el desarrollo de herramientas de código abierto Si gustas, puedes patrocinarme para el mantenimiento de la herramienta: https://github.com/sponsors/vysecurity Descargo de responsabilidad El proyecto debe utilizarse únicamente con fines educativos y de prueba. Autores LinkedInt por Vince...

CSRF-exploit-generator

CSRF-exploit-generator El generador de exploits CSRF permite a los usuarios generar un formulario de explotación CSRF con parámetros configurables. CSRF-exploit-generator Características URL de destino de entrada: Especifica la URL que se va a explotar. Parámetros POST de entrada: Permite añadir...

CLEANSTART-2026-ED72933 html

Security vulnerability affects the consul package. The html...

CLEANSTART-2026-NS73897 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-LK92318 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-LZ15854 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-TS90060 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the consul package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-RI83970 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

bleach

Bleach NOTA: 2026-06-05: Bleach ya no recibe mantenimiento. No habrá futuras versiones, incluyendo para problemas de seguridad. Ver problema: Bleach es una biblioteca de sanitización HTML basada en listas permitidas que escapa o elimina marcado y atributos. Bleach también puede añadir enlaces de...

PT-2026-104395

Name of the Vulnerable Software and Affected Versions prosemirror-view versions prior to 1.42.3 Description The view component, which manages the editable browser interface for documents, contains a flaw in its paste handling. It accepts attacker-provided HTML where the clipboard slice context...

CVE-2026-104413: Improper Neutralization of Input During Web Page Generation

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2026-93756: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

UBUNTU-CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-103627: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-104450: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

Google Chrome < 154.0.8037.97 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop advisory. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remo...