GHSA-XC4C-849C-886M vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-73299: Improper Control of Generation of Code

Prompty is a markdown file format .prompty for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype propertie...

PT-2026-71260

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test email settings action, which are evaluated when an SMTP rejection reflects the recipient addres...

CVE-2026-19160

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the disclosure of sensitive cross-origin data. Mitigation...

CVE-2026-19176

A flaw was found in Skia, a 2D graphics library. A remote attacker, who has already compromised the renderer process, could exploit a use-after-free vulnerability by providing a specially crafted HTML page. This could lead to the execution of arbitrary code within the sandbox environment,...

CVE-2026-19172

A flaw was found in Chromium's Views component. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could potentially lead to a sandbox escape, allowing the attacker to execute code outside the confined...

CVE-2026-19161

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data. Mitigation Mitigation for thi...

CVE-2026-19154

An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=532941869 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-19177

A flaw was found in Chromium. A remote attacker, after compromising the renderer process, could exploit insufficient validation of untrusted input in the user interface UI by crafting a malicious HTML page. This could potentially allow the attacker to escape the browser's security sandbox, leadin...

CVE-2026-19148

A flaw was found in the GPU component of Google Chrome on Linux. A remote attacker, who has already compromised the renderer process, could exploit an out-of-bounds write vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to...

CVE-2026-19153

A flaw was found in Google Chrome. Insufficient validation of untrusted input in the Workers component could allow a remote attacker, who has already compromised the renderer process, to bypass site isolation. This could enable the attacker to access sensitive information or further compromise th...

CVE-2026-19137

A flaw was found in Google Chrome on Android. This vulnerability, a use-after-free error in the WebGL component, could be exploited by a remote attacker. After compromising the renderer process, the attacker could craft a malicious HTML page to trigger the flaw. This could potentially lead to a...

CVE-2026-48046

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...

CVE-2026-48056

Streambert (Electron desktop app) versions prior to 2.5.0 are vulnerable due to improper validation of executable paths in the run-download IPC handler, enabling a compromised renderer to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 patches this. No exploitati...

CVE-2026-48056 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

CVE-2026-19434

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

EUVD-2026-56146

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...