Google Chrome Downloads Unauthorized Access

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of Google Chrome and Microsoft Edge browsers relates to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of Google Chrome and Microsoft Edge web browsers is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

PT-2026-111131

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description Applications based on SAP GUI for HTML do not sufficiently sanitize user-supplied content in certain functionality. This allows an authenticated attacker to send...

CVE-2026-103418: Improper Neutralization of Input During Web Page Generation

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-92883: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a...

PT-2026-113473

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An observable discrepancy in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using...

CVE-2026-110101: Improper Neutralization of Input During Web Page Generation

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-110141: Observable Discrepancy

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-113502

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in Bindings, which allows a remote attacker to read memory inside the sandbox by using a specially crafted HTML page. Use after free is a memory corruption...

CVE-2026-102989: Improper Neutralization of Input During Web Page Generation

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-110228: Improper Neutralization of Input During Web Page Generation

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-110146: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-104937: Undefined Security Weakness

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

PT-2026-111445

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists in the DOM: Core & HTML component. Use-after-free is a memory...

PT-2026-111446

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 115.43 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists within the DOM: Core & HTML...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:4625-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4625-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...

PT-2026-113484

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.79 Description A heap-based buffer overflow exists in ANGLE, a compatibility layer that translates OpenGL ES calls to other graphics APIs. This issue allows a remote attacker to potentially...

PT-2026-113498

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A buffer overflow exists in the Animation component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HT...