CVE-2026-100813: Release of Invalid Pointer or Reference

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

PT-2026-102905

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

SUSE CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

SUSE CVE-2026-67410

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

CVE-2026-102333

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333

The application httpdbg versions prior to 2.2.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the software fails to validate URL schemes for recorded HTTP request URLs displayed as clickable links in its web interface. An attacker who can control the traffic recorde...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

Improper Encoding or Escaping of Output

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the bundled domino dependency, which is used for server-side DOM emulation during Angular Universal rendering. An...

CVE-2026-101915

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) is vulnerable to sensitive information disclosure . When an application method handler throws an uncaught error, the server includes the resulting error message in the status message sent to the client. This allows an attacker to po...

CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

DEBIAN-CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

DEBIAN-CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

UBUNTU-CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101912

The ip-address JavaScript library for parsing and manipulating IPv4 and IPv6 addresses is vulnerable in versions prior to 10.7.1 . The isInSubnet and isHostInSubnet methods in src/common.ts fail to validate that both operands belong to the same IP family when comparing masked binary strings. This...

EUVD-2026-88396

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...