CVE-2026-35208

CVE-2026-35208 affects lichess.org: an Unsanitized Stream Title Injection occurs in the streamer workflow where approved streamers can inject HTML into the /streamer page and the Live streams widget by providing a title, which is rendered in the UI as-is. CSP blocks inline scripts, but the vulner...

CVE-2026-35208 lichess.org has an Unsanitized Stream Title Injection on /streamer

lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is...

RealPlayer for Windows < Build 12.0.1.609 Multiple Vulnerabilities

According to its build number, the installed version of RealPlayer on the remote Windows host is affected by multiple vulnerabilities: - An error in the 'Cook' codec initialization function and can be used to access uninitialized memory. CVE-2010-0121 - Freed pointer access in the handling of the...