EUVD-2026-78221

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2026-90835

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2026-90835

A cross-site scripting (XSS) vulnerability exists in michaelliao itranswarp (up to version 2.19), specifically in the function Markdown.toHtml within Markdown.java under the Page Content Rendering component. The flaw allows a remote attacker to inject scripts via crafted page content. The exploit...

CVE-2026-90835 michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2022-42095

Backdrop CMS バージョン 1.23.0 脆弱性の説明: Backdrop CMS バージョン 1.23.0 には、Page コンテンツを介した格納型クロスサイトスクリプティング XSS 脆弱性が含まれていることが判明しました。 攻撃ベクター: 攻撃者は「Page content」に何かを投稿し、「Body」入力に XSS ペイロードを挿入し、Raw HTML エディタを選択して格納型 XSS を悪用する必要があります。XSS ペイロードは保存後すぐに実行されます。 影響を受けるバージョン: http://ipaddress//backdrop/node/add/page PO...

EUVD-2026-75231

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused...

EUVD-2025-210833

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin prior to version 1.3.5 provides page-level content protection that can be bypassed via the WordPress REST API , allowing an unauthenticated, remote attacker to access otherwise password-protected page content. The vulnerability requires no special p...

django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-74328 iommufd: Destroy the pages content after detaching from dmabuf

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

SUSE CVE-2026-17779

Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17971

Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-50887

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17830

CVE-2026-17830 concerns Chrome for iOS (Google Chrome on iOS) prior to 151.0.7922.72, where an inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Root cause: implementation flaw in the iOS Chromium-based webview. Impact: navigation re...

CVE-2026-17797

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17703

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: High...

CVE-2026-59936

A flaw was found in pypdf, a pure-Python PDF library. A remote attacker can craft a malicious PDF document containing an unterminated inline image within its page content stream. When a user processes this crafted PDF, such as during text extraction, the vulnerability causes an infinite loop,...