morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-87521

A flaw was found in WebMCP in Chromium. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive cross-origin data...

CVE-2026-87653

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could lead to user interface UI misrepresentation in FullScreen mode, allowing the attacker to spoof UI elements...

CVE-2026-87491

A flaw was found in chromium-browser. A remote attacker could exploit an out-of-bounds write vulnerability in the V8 JavaScript engine by crafting a malicious HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox environment...

CVE-2026-87435

A flaw was found in Google Chrome's ControlledFrame. A remote attacker, who has compromised the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-87589

A flaw was found in Chromium's SiteIsolation component. A remote attacker, who has already compromised the browser's renderer process, could exploit incorrect authorization by crafting a malicious HTML page. This could allow them to bypass system access restrictions...

CVE-2026-87583

A flaw was found in Chromium, specifically within the Passwords user interface UI in Google Chrome on Android. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This would allow the attacker to spoof UI elements, potentially misleading users...

CVE-2026-79022

A flaw was found in Google Chrome. A remote attacker, leveraging social engineering, could exploit a user interface UI misrepresentation vulnerability. By crafting a malicious HTML page, the attacker could potentially spoof UI elements, which might mislead users...

CVE-2026-79283

A flaw was found in Google Chrome. A remote attacker could exploit a user interface UI misrepresentation vulnerability in the Geometry component by crafting a malicious HTML page. This could allow the attacker to spoof UI elements, potentially deceiving users...

CVE-2026-79274

A flaw was found in chromium-browser. A remote attacker could exploit a vulnerability in the GPU component by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive data from other origins...

CVE-2026-79030

A flaw was found in Chromium's Autofill feature. A remote attacker could exploit an observable discrepancy by crafting a malicious HTML page. This could allow the attacker to obtain sensitive user information...

CVE-2026-79068

A flaw was found in Google Chrome's StreamsAPI. A remote attacker could exploit improper resource exposure by crafting a malicious HTML page. This could potentially allow the attacker to bypass the web origin policy and gain access to a privileged page...

CVE-2026-79072

A flaw was found in Google Chrome. A remote attacker could exploit improper state validation in the Performance component by crafting a malicious HTML page. This could potentially allow the attacker to read sensitive memory within the browser's sandbox, leading to information disclosure...

CVE-2026-79209

A flaw was found in Google Chrome's Animation component. A remote attacker could exploit a type confusion vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code within the browser's sandbox, leading to unauthorized actions or data...

CVE-2026-79097

A flaw was found in Chromium. A remote attacker could exploit a use-after-free vulnerability in the V8 JavaScript engine by crafting a malicious HTML page. This could allow the attacker to execute arbitrary code within the sandbox environment, potentially leading to a compromise of the affected...

CVE-2026-16413

A flaw was found in ANGLE, a component of Chromium. A remote attacker who has compromised the renderer process could exploit an out-of-bounds write vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to escape the sandbox, leading to further system compromis...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the file upload process. An attacker can execute arbitrary JavaScript code in the context of another user's browser by uploading a crafted HTML file and convincing an admin or the...

PYSEC-2026-1509 langchain Server-Side Request Forgery vulnerability

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization

A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and...

CVE-2025-36321

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...