116770 matches found
firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component...
firefox: thunderbird: Use-after-free in the DOM: HTML Parser component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...
SUSE CVE-2026-109724
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
SUSE CVE-2026-109725
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
EUVD-2026-100633
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-100636
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...
EUVD-2026-100653
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
PT-2026-114034
šØ CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to...
CVE-2026-110718: Server-Side Request Forgery (SSRF)
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...
CVE-2026-103974: Improper Neutralization of Input During Web Page Generation
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...
CVE-2026-110592: Improper Encoding or Escaping of Output
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...
CVE-2026-97315: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...
USB Component Compromise Protected Information
The vulnerability of the USB component in Google Chrome and Microsoft Edge browsers is related to improper authentication procedures. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information through a specially created HTML page...
WebRTC Component Access Protected Information
The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to insufficient validation of input protected information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...
Animation Component Google Chrome Microsoft Edge DoS
The vulnerability of the Animation component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
Sandbox DoS
The vulnerability of the Sandbox component in Google Chrome and Microsoft Edge relates to improper authentication. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially created HTML page...
Preload Component Access Information Disclosure
The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to insufficient validation of the input protected information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...
Animation Component Google Chrome Microsoft Edge DoS
The vulnerability of the Animation component in Google Chrome and Microsoft Edge relates to errors in type conversion of protected information. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
Google Chrome Microsoft Edge DoS
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
SiteIsolation Component Google Chrome Microsoft Edge Protected Information
The vulnerability of the SiteIsolation component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow a remote attacker to gain access to protected information through a specially created HTML page...