6710 matches found
CVE-2026-17943
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17674
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...
CVE-2026-17943
CVE-2026-17943 : In Google Chrome, an Inappropriate implementation in the Parser allows a remote attacker to bypass Content Security Policy via a crafted HTML page. Affected software is Chrome prior to version 151.0.7922.72. The issue is described as a CSP bypass due to parser behavior; impact is...
CVE-2026-17943
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17943
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
EUVD-2026-50869
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17674
CVE-2026-17674 affects Google Chrome up to version 151.0.7922.72, where an inappropriate HTML implementation can allow a remote attacker to bypass the Content Security Policy via a crafted HTML page. The issue is described as a CSP bypass in Chrome’s HTML handling (Chromium) with High severity. A...
CVE-2026-17674
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...
EUVD-2026-50800
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...
PT-2026-65993
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...
PT-2026-66262
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746
Rouille 0.4.0–3.6.2 contains an HTTP response splitting vulnerability. An attacker can inject CR/LF into attacker-controlled input, causing arbitrary response headers to be added via reflected percent-decoded query parameters or bare LF in Cookie headers into Set-Cookie headers. This enables cach...
EUVD-2026-49889
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
PT-2026-65517
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
MGASA-2026-0296 Updated yelp packages fix a security vulnerability
The updated packages fix a security vulnerability: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications. CVE-2026-13601...
CVE-2026-64391
The CVE-2026-64391 issue affects the Linux kernel ksmbd component, where alternate data streams (ADS) stored as xattrs were read/written using current task credentials via VFS xattr paths. The root cause is that ADS I/O did not use the credentials captured when the SMB handle was opened, allowing...