CVE-2026-78325: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

PT-2026-86683

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

CVE-2026-86431: Improper Neutralization of Input During Web Page Generation

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

CVE-2026-86440: Improper Neutralization of Input During Web Page Generation

Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MIS...

PT-2026-86797

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handler...

Linux Distros Unpatched Vulnerability : CVE-2026-86315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to...

The vulnerability of the IBM Sterling Partner Engagement Manager software lies in its lack of measures to protect the website structure. This allows attackers to execute arbitrary JavaScript code and disclose protected information.

The vulnerability of the IBM Sterling Partner Engagement Manager software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code and disclose protected information...

The vulnerability of the IBM Sterling B2B Integrator and IBM Sterling File Gateway software solutions lies in their lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code and disclose sensitive information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file gateway software lies in the lack of security measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code and...

The vulnerability of the IBM Sterling B2B Integrator and IBM Sterling File Gateway software solutions lies in their lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code and disclose sensitive information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file gateway software lies in the lack of security measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code and...

The vulnerability of the IBM Sterling B2B Integrator and IBM Sterling File Gateway software solutions lies in their lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code and disclose sensitive information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file gateway software lies in the lack of security measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code and...

Devnull

DevNull DevNull is a Python CLI that automates the early, rep...

CVE-2026-84219: Improper Neutralization of Input During Web Page Generation

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

v8-sandbox-poc-clean

V8 Sandbox Escape PoC ⚠️ CRITICAL SECURITY WARNING ⚠️...

exploitBenchSkill

OpenSec ExploitBench V8 PoC Skill An installable Pi and Agent...

CVE-2026-86185

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

EUVD-2026-71994

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

CVE-2026-86185

Bilibili Desktop through 1.18.0 contains two compounding weaknesses: TLS certificate verification is disabled process-wide, and unsigned remote JavaScript configuration is executed without integrity checks. An on-path attacker can intercept configuration fetches, inject arbitrary JavaScript that ...

CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

CVE-2026-52773

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...