CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

DEBIAN-CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-65766

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79195

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79195

A use after free vulnerability in the Script component of Google Chrome (prior to version 152.0.7977.65) allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue also impacts Chromium-based browsers, including Microsoft Edge . Remediation includes ...

CVE-2026-63586

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

CVE-2026-63586 Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

CVE-2026-63586

CVE-2026-63586 is a critical (CVSS 3.1: 9.8) unauthenticated remote code execution vulnerability in a web-based management interface that uses a modified uhttpd server with CGI shell scripts. The root cause is a shell injection flaw: the HTTP Basic Authentication username is taken directly from t...

Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

MAL-2026-14486 Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

MAL-2026-14482 Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

MAL-2026-14479 Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

Malicious code in vite-plugin-image-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04 The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline into...