DEBIAN-CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

Google Chrome versions prior to 153.0.8010.52 are vulnerable to a UI misrepresentation in the WebAppInstalls component. A remote attacker can leverage social engineering to spoof UI elements by tricking a user into visiting a crafted HTML page. This issue has been addressed in version 153.0.8010....

EUVD-2026-82490

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

Malicious code in tailwindcss-form-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9 Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a full...

MAL-2026-16262 Malicious code in tailwindcss-form-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9 Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a full...

CVE-2026-54504

CVE-2026-54504 affects MCP Documentation Server (@andrea9293/mcp-documentation-server) versions 1.13.0 through 1.13.1 . The root cause is that app.listen(PORT) in src/web-server.ts is called without a host argument, causing the Express server to bind to all interfaces (0.0.0.0:3080) rather than l...

Malicious Package

Overview leda-element-ui-radiant-sagitta is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview leafygreen-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-93386: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

PT-2026-95128

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description UI misrepresentation in WebAppInstalls allows a remote attacker to spoof UI elements through a crafted HTML page by leveraging social engineering. Recommendations Update Google Chrome t...

PT-2026-95137

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An authenticated uploader can upload an image/svg+xml assistant UI logo via the 'PATCH /api/v1/system/assistant/ui' endpoint. The system stores the SVG without sanitizing or validating embedded active...

CVE-2026-53555: Improper Neutralization of Input During Web Page Generation

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

GHSA-FFMG-HFVG-JHG9 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

SUSE CVE-2026-91713

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...