Lucene search
+L

60540 matches found

OSV
OSV
added 2026/07/21 12:0 p.m.12 views

RUSTSEC-2026-0213 XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs. Applications that do not...

5.4AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/21 11:39 a.m.28 views

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

5.4CVSS0.0015EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/21 11:39 a.m.7 views

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

5.4CVSS5AI score0.0015EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/21 11:39 a.m.14 views

CVE-2026-64628

Grav (CVE-2026-64628) suffers a stored XSS in shortcode-core attribute handlers. The XSS bypasses validation because the detector only flags payloads with literal angle brackets, allowing shortcode parameters to inject JavaScript that runs in any viewer’s browser, including admins. Attackers with...

5.4CVSS5AI score0.0015EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/21 6:0 a.m.9 views

RLSA-2026:42088 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

8.8CVSS8.2AI score0.72648EPSS
SaveExploits16References24
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.8 views

PT-2026-63247

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description A stack buffer overflow exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary...

8.8CVSS6.4AI score0.00271EPSS
SaveExploits0References19
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.10 views

PT-2026-61867

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description A JIT miscompilation issue exists within the JIT componen...

9.8CVSS5.7AI score0.00436EPSS
SaveExploits1References82
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.13 views

PT-2026-61880

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description Incorrect boundary conditions exist within the JavaScript: WebAssembly component...

10CVSS5.2AI score0.00436EPSS
SaveExploits1References81
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.12 views

PT-2026-61904

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A JIT miscompilation issue exists within the JIT component of the JavaScript Engine. JIT Just-In-Time compilation is a method used by the engine to improve performance...

10CVSS6AI score0.09348EPSS
SaveExploits0References263
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.8 views

PT-2026-61922

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A JIT miscompilation issue exists within the JIT component of the JavaScript Engine. JIT Just-In-Time compilation is a method used by the engine to improve performance...

10CVSS6AI score0.09348EPSS
SaveExploits0References263
Tenable Nessus
Tenable Nessus
added 2026/07/21 12:0 a.m.3 views

Mozilla Firefox ESR < 115.38

The version of Firefox ESR installed on the remote Windows host is prior to 115.38. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-69 advisory. - We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing thi...

9.8CVSS6.4AI score0.00405EPSS
SaveExploits0References15
Kaspersky
Kaspersky
added 2026/07/21 12:0 a.m.12 views

KLA91164 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

10CVSS6.8AI score0.00436EPSS
SaveExploits1References2
Kaspersky
Kaspersky
added 2026/07/21 12:0 a.m.13 views

KLA91170 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

10CVSS6.8AI score0.00436EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.10 views

PT-2026-61881

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An integer overflow exists in the JavaScript: WebAssembly component. An integer overflow occu...

10CVSS5.3AI score0.00436EPSS
SaveExploits0References82
OSV
OSV
added 2026/07/20 10:40 p.m.4 views

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

8.3CVSS5.7AI score0.00304EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/20 10:31 p.m.47 views

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

0.00314EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/20 10:31 p.m.3 views

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

6.1AI score0.00314EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/20 9:35 p.m.8 views

GHSA-QFRW-5RXM-MHH2 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...

6.1CVSS5.6AI score0.00225EPSS
SaveExploits1References6
EUVD
EUVD
added 2026/07/20 9:32 p.m.12 views

EUVD-2026-42331

Mistune: XSS via percent-encoded javascript URI bypass in safeurl...

6.1CVSS5AI score0.00239EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/20 9:32 p.m.5 views

GHSA-8C25-4J27-2RV3 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

6.1CVSS5.5AI score0.00239EPSS
SaveExploits1References6
Rows per page
Query Builder