PT-2026-71345

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1 Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: URIs when the scheme is...

KLA91170 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

KLA91164 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

PT-2026-61880

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description Incorrect boundary conditions exist within the JavaScript: WebAssembly component...

PT-2026-61867

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description A JIT miscompilation issue exists within the JIT componen...

CVE-2026-16392: Always-Incorrect Control Flow Implementation

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

GHSA-QFRW-5RXM-MHH2 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

EUVD-2026-42331

Mistune: XSS via percent-encoded javascript URI bypass in safeurl...

GHSA-8C25-4J27-2RV3 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

EUVD-2026-42302

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml...

EUVD-2026-42301

js-yaml: YAML merge-key chains can force quadratic CPU consumption...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the content parameter of the /templates endpoint. An attacker can execute arbitrary JavaScript code in the browsers of users who view the affected template by injecting malicious scripts. Details Cross-site...

CVE-2026-53592 FreeScout vulnerable to prototype pollution in getQueryParam

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the getQueryParam function /public/js/main.js and was addressed in version 1.8.139 by blocking URL query keys matching the pattern proto. However, this mitigation is incomplete: i...

CVE-2026-44229

CVE-2026-44229 (RT) affects the Request Tracker project: versions 5.0.0 and 6.0.0 and above, up to but not including 5.0.10 and 6.0.3, contain an XSS vulnerability where uploaded content is served inline instead of as an attachment. An authenticated user who can upload content can inject JavaScri...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...