CVE-2026-18329: Not Failing Securely

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

PT-2026-84614

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

PT-2026-84772

In Stapler 1839.ved17667b a eb 5 through 2107.v8dfcb e8ed317 both inclusive, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

PT-2026-84666

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84793: Improper Neutralization of Input During Web Page Generation

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

Google Chrome V8 DoS

The V8 JavaScript script handler vulnerability in Google Chrome is related to improper code generation management. Exploitation of this vulnerability allows a remote attacker to cause a denial of service by using a specially crafted HTML page...

V8 JavaScript DoS

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper code generation management. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-83607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and ...

Cross-origin exposure of CSRF token

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler provides an HTTP endpoint serving dynamically generated JavaScript resources. In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6,...

V8 JavaScript DoS

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

V8 JavaScript DoS

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper memory usage after deallocation. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

V8 JavaScript DoS

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to a lack of data security mechanisms. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted HTML page...

V8 JavaScript Script Handler Code Execution

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to a data protection mechanism flaw. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code via a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-83609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in...

Linux Distros Unpatched Vulnerability : CVE-2026-83616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

PodcastGenerator 3.2.9 - Stored XSS

Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software Link: https://github.com/PodcastGenerator/PodcastGenerator Version: 3.2.9 Tested on: Windows 11 / XAMPP CVE : CVE-2025-7033...

CVE-2026-78222: NULL Pointer Dereference

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-18329: Not Failing Securely

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

CVE-2026-19723: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...