EUVD-2025-211115

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actio...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

cypht-org cypht Cross-Site Scripting Vulnerabilities

The cypht-org project has cross-site scripting vulnerabilities in versions from 2.0.0 to 2.12.2. These vulnerabilities arise when ALLOWEXTERNALIMAGESOURCES is enabled. In this case, malicious alt texts or URL values in external image tags are decoded and used to construct image prompts through...

IBM Carbon Charts Cross-Site Script Vulnerabilities

The IBM Carbon Charts versions 0.4.0 to 1.27.19 have a cross-site scripting vulnerability. This vulnerability stems from the Title.truncateTitle function in the MeterChart component. When the title exceeds the available width of the container, the function reinserts the user-provided tag text...

FacturaScripts Cross-Site Scripting Vulnerabilities

FacturaScripts version 2025.61 has a cross-site scripting vulnerability. This vulnerability stems from insufficient validation or cleaning of user inputs for the city and province fields in the ListAlmacen endpoint. It may lead to storage-based cross-site scripting attacks, allowing attackers to...

marmelab react-admin Cross-Site Scripting Vulnerability

Marmelab React-Admin versions prior to 5.15.5 have a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting issue. Attackers can inject JavaScript: URI injection scripts into record fields rendered by UrlField and FileField. When an administrator...

LINE LIFF Cross-Site Scripting Vulnerability

The LINE LIFF SDK versions 2.20.0 to 2.31.0 have a cross-site scripting vulnerability. This vulnerability stems from a DOM-based cross-site scripting issue. When a user opens a specially crafted URL in an external browser, an attacker can execute arbitrary JavaScript on the affected LIFF...

CVE-2026-112290

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290 MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...