75364 matches found
MGASA-2026-0554 Updated evolution package fixes a security vulnerability
Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...
Updated evolution package fixes a security vulnerability
Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...
PT-2026-127186
NextChat version 2.16.1 contains a client‑side cross‑site scripting XSS vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later...
PT-2026-126472
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126481
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126538
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126565
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126577
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126492
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126400
Improper neutralization of input during web page generation 'Cross-site Scripting' in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another use...
PT-2026-127756
Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...
PT-2026-125901
Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...
PT-2026-126348
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...
PT-2026-126336
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...
PT-2026-126520
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126552
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
PT-2026-126608
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159...
PT-2026-126529
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...