CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

EUVD-2026-63551

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Summary The Blade template for the color column type src/resources/views/crud/columns/color.blade.php has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column'escaped' defaults to true, values stored in color columns are rendere...

CVE-2026-63015

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

EUVD-2026-63396

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-63015 Apache InLong: Non-template responsible persons can view template information

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-64970

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...

CVE-2026-64970

ATutor 2.2.4 is vulnerable to stored XSS: a user can inject JavaScript into the registration phone field, which is echoed unencoded on the public profile page, executing in any visitor's browser to steal session cookies. The product is no longer actively supported and remains unpatched; no exploi...

CVE-2026-64970 Stored XSS in ATutor

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...

PT-2026-79119

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS...

PT-2026-79185

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.5.7 Description The Bulk Link API endpoint POST /api/v2/bulk/links lacks format validation for URLs, allowing authenticated users to store a javascript: URI. This URI is rendered verbatim as an href attribute in Bla...

Infinite loop

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Infinite loop via the striphtml filter in src/filters/html.ts, which enters an infinite loop when processing certain input strings. A...

CVE-2026-61556 LiquidJS: An infinite loop vulnerability in `strip_html` filter

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the striphtml filter in src/filters/html.ts can enter an infinite loop when an input string contains . In striphtml, the search for the next opener advances lt while the loop index...

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

GHSA-WF6J-GR27-G7CH GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Impact A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerabilit...

EUVD-2026-42309

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted...

CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...