73483 matches found
PT-2026-84666
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
CVE-2026-3850: Improper Neutralization of Input During Web Page Generation
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being rendered into...
CVE-2026-18329: Not Failing Securely
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-18329: Not Failing Securely
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows a perpetrator to execute arbitrary code.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially created HTML page from a remote location...
CVE-2026-19719: Improper Neutralization of Input During Web Page Generation
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...
CVE-2026-19723: Improper Neutralization of Input During Web Page Generation
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...
PT-2026-84614
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...
CVE-2026-78222: NULL Pointer Dereference
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...
PT-2026-84613
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...
AppNitro MachForm 30 Cross Site Scripting
AppNitro MachForm version 30 suffers from a cross site scripting vulnerability. CVE-2026-78838 Description A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim'...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to gain access to confidential data...
PT-2026-84642
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirect url parameter of the et pb contact form shortcode in all versions up to, and including, 4.27.6. This is due to the redirect url attribute being sanitized with esc attr instead of esc url before being render...
CVE-2026-84793: Improper Neutralization of Input During Web Page Generation
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 browser allows a hacker to trigger a service failure.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...