CVE-2026-17528

CVE-2026-17528 affects the nice-select2 JavaScript plugin. Versions before 2.4.1 are vulnerable to XSS via the element, where a malicious payload is rendered into the DOM and can execute arbitrary scripts in a user’s browser when interacting with affected pages. The issue is tied to insufficient...

CVE-2026-17528

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...

CVE-2026-17528

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...

Exploit for CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeo...

Fixing my tooltip accessibility mistake

I made an accessibility error, and I want you to learn from my mistakes. I've been making short videos recently about web platform features as they land in Firefox, and also about other web standards & development stuff. If you'd prefer to watch a 3-minute video version of this article, pick your...

PT-2026-65387

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...

The vulnerability affects the update service for PDF document viewing software called Foxit PDF Reader (previously Foxit Reader) and the PDF file editing software called Foxit PDF Editor (previously Foxit PhantomPDF). This vulnerability allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the PDF document viewing service in Foxit PDF Reader formerly Foxit Reader and the PDF file editing program Foxit PDF Editor formerly Foxit PhantomPDF is related to an uncontrolled search path element. Exploiting this vulnerability can allow attackers to enhance their...

TencentOS Server 2: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (TSSA-2026:0765)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0765 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

SUSE SLES16 Security Update : apache-ivy (SUSE-SU-2026:22858-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22858-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow...

PT-2026-65497

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...

PT-2026-65484

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

PT-2026-65548

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the...

PT-2026-65501

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

PT-2026-65481

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...

Multiples vulnerabilities in Curl

use after free in SMB connection reuse CVE-2026-3805 Description When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. INFO When the bad code hits, curl first makes a strlen on the freed memory pointer, then checks that t...

CVE-2026-66824

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

CVE-2026-59728

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without...

EUVD-2026-49585

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...