PT-2026-121502

A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...

PT-2026-121341

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2026-76288

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...

CVE-2026-76288

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to a Denial of Service (DoS) attack. An unauthenticated user can send a single crafted request to the Splunk Web JavaScript logger endpoint , causing Splunk Web to stop responding until the service is restarted. T...

CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...

CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-113193

A flaw was found in chromium-browser. This flaw leads to information disclosure due to a memory corruption issue in the V8 JavaScript engine. A remote attacker can exploit this vulnerability by enticing a user to view a specially crafted HTML page. Successful exploitation allows the attacker to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions,...

Cross-site Scripting (XSS)

Overview @vaadin/charts is a vaadin-charts Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options...

CVE-2026-113192

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser's sandbox environment by exploiting a memory corruption vulnerability in the V8 JavaScript engine. To trigger this flaw, the attacker must convince a user to visit a specially crafted web page...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

The Sentry-Javascript SDK for JavaScript contains a middleware bypass vulnerability in its webpack integration for @sentry/nextjs . Versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1 are affected. The root cause is that the integration skips application middleware for all paths under a conf...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-113030

A flaw was found in chromium-browser. Due to improper access control within the V8 JavaScript engine, a remote attacker can bypass the web origin policy by convincing a user to visit a crafted HTML page. The web origin policy is a foundational security boundary designed to isolate different...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...