Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to an out-of-bounds memory operation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to a lack of data protection mechanisms. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Google Chrome Microsoft Edge Protected Information Access

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to memory usage after it has been freed. Exploiting this vulnerability enables a remote attacker to gain access to protected information via a specially crafted HTML page...

Google Chrome Microsoft Edge Protected Information Access

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to type conversion errors in protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML pag...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability in the JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to an integer overflow. Exploitation of this vulnerability allows a remote attacker to cause a denial of service by using a specially crafted HTML page...

CVE-2024-5139: Improper Neutralization of Input During Web Page Generation

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

Security Bulletin: IBM @carbon/charts MeterChart vulnerable to cross-site scripting (XSS) via unsanitized title truncation (CVE-2026-94402)

Summary IBM @carbon/charts is vulnerable to cross-site scripting in the MeterChart component where Title.truncateTitle re-inserts user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width, allowing a remote attacker to execute...

CVE-2026-94402

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

CVE-2026-94402 IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

CVE-2026-94402

The IBM @carbon/charts library (including react , angular , vue , and svelte variants) is vulnerable to cross-site scripting (XSS) via unsanitized title truncation in the MeterChart component. The issue resides in the Title.truncateTitle() function, which performs an unsanitized innerHTML write o...