Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1

Export CSV
CVE-2026-82090

Untrusted HTML Injection in Pocket Allows XSS with Native Bridge Exploitation

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Getpocket
Products
Pocket