-
CVE-2026-69152
•
published on August 3, 2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
-
CVE-2026-69151
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
-
CVE-2026-69151
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
-
CVE-2026-69151
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
-
CVE-2026-69151
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
-
CVE-2026-69151
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
-
CVE-2026-18606
•
published on August 3, 2026
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
-
CVE-2026-18606
•
published on August 3, 2026
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
-
CVE-2026-18606
•
published on August 3, 2026
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
-
CVE-2026-18606
•
published on August 3, 2026
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
-
CVE-2026-18606
•
published on August 3, 2026
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
-
CVE-2026-69149
•
published on August 3, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe, <![CDATA[, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-69149'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-69149
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-69149'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-69149
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-69149'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-69149
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-69149'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-69149
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-67612'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-67612
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-67612'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-67612
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-67612'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-67612
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.</small>
</div>
</li>
<li
class="result-item"
onclick="window.location='/CVE-2026-67612'"
style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;"
>
<div style="flex:1; display:flex; flex-direction:column;">
<span>
CVE-2026-67612
<span class="separator">•</span>
<small>published on August 3, 2026</small>
</span>
<small class="ellipsis-text">OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.</small>
</div>
</li>
</ul>
<div class="center-pagination"><div class="pagination"><a href="/?page=422" class=" " >«</a><a href="/?page=1" class=" " >1</a><a href="/?page=421" class=" " >421</a><a href="/?page=422" class=" " >422</a><a href="/?page=423" class="active " >423</a><a href="/?page=424" class=" " >424</a><a href="/?page=425" class=" " >425</a><a href="/?page=294671" class=" " >294671</a><a href="/?page=424" class=" " >»</a></div></div> </div>
</div>
<footer style="text-align: center; padding: 2em 1em 1em 1em; font-size: 0.9em; color: #666; margin-top: 2em;">
Data from cve.org<br>
Compiled by Portend AI, Inc.
</footer>
<script>
document.getElementById('advisorySearchForm').addEventListener('submit', function (e) {
e.preventDefault(); // Prevent the default form submission
const searchValue = document.getElementById('searchInput').value.trim();
if (searchValue) {
// Redirect to the desired URL
window.location.href = '/' + encodeURIComponent(searchValue);
}
});
</script>
</body>
</html>
]]>
