EUVD-2026-93800

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106366

A high-severity vulnerability exists in the CustomTabs component of Google Chrome on Android prior to version 155.0.8059.39 . The root cause is an incomplete cleanup flaw, which allows a remote attacker to bypass the web origin policy by navigating the user to a crafted HTML page. This issue has ...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-104069

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

EUVD-2026-93436

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069

HortusFox versions prior to 6.2 are vulnerable to Remote Code Execution (RCE) via the ThemeModule::startImport() function. The root cause is the direct extraction of uploaded ZIP archives into the public web root without validating filenames, extensions, or content. An authenticated administrator...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Web Plura Backup & Restore Manager versions = 0.2.25...

CVE-2026-32570

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-32570

The Progressify - Progressive Web App (PWA) plugin for WordPress is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions

CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

EUVD-2026-93233

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

EUVD-2026-93225

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2...

CVE-2026-105487

The yogeshojha reNgine software (versions up to 2.2.0 ) is vulnerable to an OS command injection vulnerability within the listTargets Endpoint . Specifically, the subdomain_discovery function located in the web/reNgine/tasks.py file fails to properly neutralize the Name argument. This flaw allows...

cve-2020-24572

CVE-2020-24572 Se descubrió un problema en includes/webconsole.php en RaspAP 2.5. Con acceso autenticado, un atacante puede utilizar una consola web mal configurada y prácticamente sin restricciones para atacar el sistema operativo subyacente que ejecuta este software, y ejecutar comandos en el...

Out-of-Bounds Memory Access Leading to Management Interface Denial of Service

: An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...