109807 matches found
CVE-2026-85271
Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...
CVE-2026-77607
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the DebugFormatter process. An attacker can execute arbitrary scripts in the context of the user's browser by crafting a malicious query that injects unescaped HTML or JavaScript into the debug output. This ...
CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...
CVE-2025-53837
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
CVE-2025-53837
XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...
EUVD-2025-210935
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...
CVE-2026-79294
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
CVE-2026-19873
A flaw was found in HTML::FormFu for Perl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request with an unbounded repeat count to a Repeatable element. The application's process method reads the repeat count from the query string,...
Cross-site Scripting (XSS)
Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...
CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)
The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...
CVE-2026-79294
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
CVE-2026-79294
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
Linux Distros Unpatched Vulnerability : CVE-2026-93385
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...