CVE-2026-91201

DocsGPT through 0.20.0 is affected by an OAuth token disclosure via a wildcard postMessage in the callback-status endpoint. Session tokens are posted without validating the sender origin, allowing an attacker acting as window.opener during the OAuth authorization flow to steal session tokens and ...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-82019

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

EUVD-2026-77522

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2026-82019

TripleLift's ad rendering script (video-bundle.js ) is vulnerable to a DOM-based cross-site scripting (XSS) flaw caused by the absence of origin validation on postMessage events. An unauthenticated attacker can craft a malicious page that sends postMessage payloads to a publisher page loading the...

CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2026-82019: Improper Neutralization of Input During Web Page Generation

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

PT-2026-91224

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82809

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811

CVE-2026-82811 affects the Toggl Track Chrome extension (version 4.11.16 ). The vulnerability resides in the extension's postMessage Handler , which fails to properly validate message origins, allowing an attacker to accept forged session-state messages through an unauthenticated handler. The att...

EUVD-2026-68679

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82809 vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

EUVD-2026-68656

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82809 vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...