PT-2026-54199

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Side-channel information leakage in the Paint component allows a remote attacker to leak cross-origin data by using a crafted HTML page. Side-channel leakage occurs when information is...

PT-2026-54358

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in HTML allows a remote attacker to perform Universal Cross-Site Scripting UXSS, which is a vulnerability that enables the execution of...

PT-2026-54418

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 150.0.7871.47 Description Incorrect security UI in the Passwords feature allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by usi...

PT-2026-54431

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient policy enforcement in the StorageAccessAPI allows a remote attacker who has compromised the renderer process to bypass the same origin policy using a crafted HTML page. The...

PT-2026-54065

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description A use after free issue exists in the Fullscreen component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption....

PT-2026-54215

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An integer overflow in the Fonts component allows a remote attacker to perform an out-of-bounds memory write by inducing the user to open a crafted HTML page. An integer overflow occurs...

PT-2026-54303

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the SignIn function. A remote attacker could potentially exploit heap corruption—a condition where the heap memory is corrupted, leading to unpredictabl...

PT-2026-54403

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 150.0.7871.47 Description An improper implementation in the browser allows a remote attacker to spoof the contents of the Omnibox the address and search bar by using a specially crafted HTML page...

PT-2026-54122

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue in the DOM Document Object Model allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to open a specially crafted HTML page. U...

PT-2026-54348

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in WebXR allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. WebXR is an API that enables web application...

PT-2026-54067

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A side-channel information leakage issue exists in the Scroll component. This flaw allows a remote attacker to leak cross-origin data, which is data belonging to a different origin than...

PT-2026-54290

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in the Paint component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by...

PT-2026-54059

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Browser component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-54310

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient policy enforcement in the Bluetooth component allows a remote attacker to obtain potentially sensitive information from process memory. This is achieved by inducing the use...

PT-2026-54377

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Passwords component. This flaw allows a remote attacker to potentially exploit heap corruption, which occurs when a program continues to use a point...

Cross-site Scripting (XSS)

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the number guess process. An attacker can execute arbitrary...

Microsoft Edge (Chromium) < 149.0.4022.98 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 149.0.4022.98. It is, therefore, affected by multiple vulnerabilities as referenced in the June 26, 2026 advisory. - Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote...

GHSA-75MW-H36V-2JV7 Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers

Summary The HTML and RSS output handlers in dosagelib/events.py write user-controlled content comic text and page URLs directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can...

CVE-2026-13283

Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-13033

Out of bounds read and write in BlinkInterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Critical...