ROS-20260909-73-0171

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-18147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password...

ROS-20260909-73-0121

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0123

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0084

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0079

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0061

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2026-18147: Improper Neutralization of Input During Web Page Generation

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

The vulnerability of the html_entity_decode() function in the phpMyFAQ web application allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the htmlentitydecode function in the phpMyFAQ web application is related to the lack of protective measures for the website’s structure. Exploiting this vulnerability could allow an attacker to execute arbitrary JavaScript code remotely...

CVE-2026-87813: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

PT-2026-89152

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

PT-2026-88862

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

ROS-20260909-73-0087

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0134

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0128

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260909-73-0126

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to improper code generation. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0125

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

ROS-20260909-73-0053

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

PT-2026-88878

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...