69403 matches found
PT-2026-93291
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...
PT-2026-93323
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper sanitization of pasted HTML content in the Content Editor could allow an unauthenticated user to...
CVE-2026-84088: Improper Neutralization of Input During Web Page Generation
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...
CVE-2026-61597: Improper Neutralization of Input During Web Page Generation
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...
CVE-2026-63325: Improper Control of Generation of Code
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...
SUSE CVE-2026-92021
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
SUSE CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-15639 Reflected Cross-Site Scripting
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...
CVE-2026-15639
CVE-2026-15639 is a Reflected Cross-Site Scripting vulnerability in a Delinea product (specific product and version not detailed in the provided documents). An attacker crafts a malicious link that, when clicked by a legitimate user, causes the user's browser to execute attacker-supplied JavaScri...
CVE-2026-15639 Reflected Cross-Site Scripting
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...
CVE-2026-91728
An integer overflow flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=556715288...
CVE-2026-92234
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...
CVE-2026-81927
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...
CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...
EUVD-2026-79945
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...
CVE-2026-81927
Concrete CMS before 9.5.3 contained a stored XSS vulnerability in its SVG file handling. The flaw is triggered only when SVG sanitization is set to the non-default "reject" mode (concrete.file_manager.images.svg_sanitization.action = reject). In that mode, uploaded SVGs were checked against a sma...
CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...
CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...
CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...