org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-19873

A flaw was found in HTML::FormFu for Perl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request with an unbounded repeat count to a Repeatable element. The application's process method reads the repeat count from the query string,...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...

Linux Distros Unpatched Vulnerability : CVE-2026-93385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

CVE-2026-77607: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-77606: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...

EUVD-2026-82973

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

Linux Distros Unpatched Vulnerability : CVE-2026-93379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-93382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-93383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...

PT-2026-95386

Name of the Vulnerable Software and Affected Versions Moonshot AI Kimi versions prior to 2026-07-18 Description A Cross Site Scripting XSS issue exists where a remote attacker can execute arbitrary code. This occurs through the HTML artifact Preview rendering within the public Share view componen...

PT-2026-95515

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used to store and query data. The software fails to sanitize the sep variable when it is inserted into the HTML that joins tabl...

Linux Distros Unpatched Vulnerability : CVE-2026-93380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social...

PT-2026-95285

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.5 Description Stored Cross-Site Scripting occurs via the kubio/copyright Block Content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level acces...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 < Security 2026 Update 3 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, or 12.0 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in Esri Portal for ArcGIS that may under...

Linux Distros Unpatched Vulnerability : CVE-2026-93377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbo...