CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-95682

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-59940

A flaw was found in Seroval, a JavaScript JS value stringification library. The seroval.fromJSON function allows a remote attacker to provide specially crafted JSON Promise control nodes. These nodes can operate on deserialized values without proper verification, leading to unintended server-side...

CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

EUVD-2026-84374

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

CVE-2026-95661 MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP contains a reflected cross-site scripting XSS vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated...

K000163365: Serialize-JavaScript NPM vulnerability GHSA-5c6j-r48x-rmvq

Security Advisory Description The serialize-javascript npm package versions tags, the injected code executes. GHSA-5c6j-r48x-rmvq Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently supported...

PT-2026-97088

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper neutralization of HTML input allows a remote attacker to execute arbitrary JavaScript within the browser of an authenticated user...

CVE-2026-95661: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

PT-2026-97130

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description An out-of-bounds heap write in the Goja JavaScript runtime embedded in the javascript: protocol under pkg/js/ allows arbitrary native code execution on the host running the scanner. This occurs...

PT-2026-96721

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A reflected cross-site scripting XSS issue exists in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to...

PT-2026-96834

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The nuclei/mysql JavaScript library fails to enforce the local-file sandbox when a JavaScript template uses the allowAllFiles MySQL DSN option. This allows an untrusted javascript: template...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-95682: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = " ";. Because the value was placed inside a double-quoted...

CVE-2026-75697: Improper Neutralization of Input During Web Page Generation

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...