CVE-2026-67196

Vulnerability : In Perspective 5.0.0, the built-in Debug plugin is vulnerable to cross-site scripting via innerHTML interpolation during CSV serialization. Trigger : attackers craft table rows whose cells contain unescaped HTML markup, including unquoted event-handler attributes, which are not es...

CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

ROS-20260804-73-0024

The vulnerability of the DRM/amdkfd component in Linux kernel relates to pointer arithmetic errors. Exploiting this vulnerability allows an attacker to trigger a service failure...

CVE-2026-16881: Undefined Security Weakness

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

SUSE CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-49132

OPNsense before 26.1.9 is affected by a stored XSS in the trust certificate API: when an attacker consolidates payloads into a certificate description, the unsanitized value is persisted and later rendered in the Dashboard Certificates widget (Certificates.js) via HTML attribute/text sinks, allow...

CVE-2026-66296

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-69149 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-18550630...

Cross-site Scripting (XSS)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Cross-site Scripting XSS in the bundled domino DOM serializer, which does not escape text nodes inside the fallback raw-content elements , , , and during SSR...

GHSA-VPX6-8PJR-4G3V Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=19.2.18, <=19.2.25)

@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 - mat-typeahead-library-custom123 0.0.0 and more Source cves: CVE-2026-69149 Source advisory: OSV:GHSA-VPX6-8PJR-4G3V...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-69149 Source advisory: OSV:GHSA-VPX6-8PJR-4G3V...

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

CVE-2026-69149

CVE-2026-69149 affects Angular SSR: a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) used by @angular/platform-server when serializing fallback raw-content elements (, , , ). The issue exists prior to versions 20.3.27, 21.2.19, and 22.0.7 and is fixed in those r...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the HttpTransferCache used for server-side rendering, which builds the transfer-cache key by joining repeated HttpParams values with commas so that distinct parameter shapes produce the...

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering SSR so that they can be reused during client-side hydration. During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because...

GHSA-JHPW-976M-542J Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering SSR so that they can be reused during client-side hydration. During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because...

CVE-2026-69078

CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...