EUVD-2026-85156

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91818 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91818 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91818

A use-after-free vulnerability exists in Foxit PDF Editor/Reader 's JavaScript handling of PDF annotations. The root cause is reentrant page-event processing during annotation enumeration, which may release the associated page object; subsequent access to this object results in an application cra...

CVE-2026-88997

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

CVE-2026-88997

The JSM Show Post Metadata WordPress plugin versions before 4.9.1 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper escaping of a post meta key before it is outputted into an inline event-handler attribute within an admin-facing meta box. This allows users ...

EUVD-2026-85041

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

MAL-2026-16458 Malicious code in tuxcmdfhjkw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed907ab556a271a706db9227bfa0cd751f7a3dae9005bca41167ffdfc8be75b8 The package's only shipped file is an HTML page that mimics a Cloudflare 'Just a moment...' verification screen and embeds obfuscator.io-style...

CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript

Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...

EUVD-2026-84953

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-91806: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

CVE-2026-91791: Use After Free

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in ...

PT-2026-97207

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An information disclosure issue exists in the JavaScript interface implementation where attribute authorization checks required by the specification are not performed. This...

PT-2026-97407

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0 Description The @orval/hono generator fails to escape OpenAPI path values within single-quoted route literals. This allows an attacker to craft an OpenAPI document containing an apostrophe in a static path segmen...

CVE-2026-96754: Improper Control of Generation of Code

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2026-84683: Improper Neutralization of Input During Web Page Generation

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-91792: Use After Free

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...

CVE-2026-91788: Exposure of Resource to Wrong Sphere

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it...