CVE-2026-73858

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-73858

The Solspace Freeform plugin for Craft CMS (versions 5.0.0 through 5.10.13) is vulnerable to a limited server-side Twig template injection (SSTI). An unauthenticated attacker can submit Twig expressions through public Freeform forms; these expressions are evaluated by the isolated Twig renderer w...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-73858: Improper Neutralization of Special Elements Used in a Template Engine

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

Linux Distros Unpatched Vulnerability : CVE-2026-91735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execu...

Linux Distros Unpatched Vulnerability : CVE-2026-91727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process...

Linux Distros Unpatched Vulnerability : CVE-2026-91724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute...

CVE-2026-79147

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially lead to the disclosure of sensitive informatio...

EUVD-2026-84180

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...

chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation

A flaw was found in Skia, a 2D graphics library used in chromium-browser. This improper state validation vulnerability allows a remote attacker, who has already compromised the renderer process, to read memory outside of the security sandbox. This can be achieved by enticing a user to open a...

chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Skia

A flaw was found in Skia, a 2D graphics library used in Chromium. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the leakage of sensitive cross-origin data, potentially exposing...

chromium-browser: skia: chromium-browser: skia: Cross-origin data leakage via uninitialized use

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data...

chromium-browser: angle: Chromium: Sandbox escape via out-of-bounds write in ANGLE

A flaw was found in ANGLE, a component of Chromium. A remote attacker who has compromised the renderer process could exploit an out-of-bounds write vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to escape the sandbox, leading to further system compromis...

chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia

An inappropriate implementation flaw was found in Skia in Google Chrome. This issue may allow a remote attacker to compromise the renderer process to perform a sandbox escape via a crafted HTML page...

chromium: skia: chromium: skia: Heap buffer overflow in Skia

Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Google Chrome

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the disclosure of sensitive cross-origin data...

chromium: skia: chromium: skia: Heap buffer overflow in Skia

Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...