65522 matches found
CVE-2026-27568 AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown v1.7.4 without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing javascript: URIs to be rendered as clickable links. An authenticated...
CVE-2026-27568 AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown v1.7.4 without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing javascript: URIs to be rendered as clickable links. An authenticated...
CVE-2026-27568
WWBN AVideo (open source video platform) is affected prior to version 21.0 by CVE-2026-27568, where Markdown in video comments processed by Parsedown v1.7.4 without Safe Mode allows javascript: URIs to be rendered as links. An authenticated low-privilege attacker can post a malicious comment whos...
CVE-2026-2795
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2796
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2804
Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2797
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2801
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2795
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2797
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2801
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2804
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2796
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2802
Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2786
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
CVE-2026-2786
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
CVE-2026-2785
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
CVE-2026-2783
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...