EUVD-2026-112693

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

CVE-2024-40510

CVE-2024-40510 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMCommon.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMCommon.asmx function. Vulnerable Product Version...

PT-2026-127854

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab index, empty notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Exploit for Use After Free in Linux Linux_Kernel

Galaxy Tab S10 FE — ADB root CVE-2026-43499 / GhostLock + Ker...

CVE-2026-113797

The Electron framework, prior to versions 42.11.1 , 43.5.1 , 44.1.1 , and 45.0.0-alpha.4 , contains a vulnerability where the chrome.tabs.query() function returns the URL and title of every tab to extensions lacking the tabs permission or matching host permissions. This allows an untrusted extens...

CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query returned each tab's url and title to extensions that had neither the tabs permission nor matching host...

CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query returned each tab's url and title to extensions that had neither the tabs permission nor matching host...

Oracle Linux 10 : environment-modules (ELSA-2026-80664)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-80664 advisory. 5.6.1-2.1 - fix command injection in bash Tab completion CVE-2026-85013 RHEL-260562 Tenable has extracted the preceding description block directly from the...

Oracle Linux 9 : environment-modules (ELSA-2026-84594)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84594 advisory. 5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013 Tenable has extracted the preceding description block directly from the Oracle Linux...

environment-modules security update

5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013...

CVE-2026-104003 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

Lenovo Idea Tab Pro (TB373FU) licensing issues and vulnerabilities

The Lenovo Idea Tab Pro TB373FU has an authorization issue vulnerability. This vulnerability stems from an authentication bypass, which may allow users with physical access rights to access the device without proper authorization...

Lenovo Idea Tab Pro (TB373FU) has vulnerabilities related to trust management.

The Lenovo Idea Tab Pro TB373FU has a trust management vulnerability. This vulnerability arises because users with physical access rights can access unlocked tablets, bypassing device protections and executing arbitrary code...

Astra Linux – Vulnerability in Chromium

The use of after-free in TabStrip in Google Chrome before version 149.0.7827.103 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Thunderbird, Firefox

When importing an SPKI RSA public key as an ECDSA P-256 key, the key is handled incorrectly, causing the tab to crash. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

A “paste” button on a clipboard could be present across tabs, allowing for a spoofing attack. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could cause a select dropdown menu to be displayed over another tab; this could lead to user confusion and potential spoofing attacks. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

Astra Linux – vulnerability in Chromium

Prior to version 153.0.8010.47, using “After Free” in the Auth tab in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in the Tab Strip component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to perform domain spoofing through a crafted HTML page. Chromium security severity: Low...

Astra Linux – vulnerability in Chromium

The incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Low...