CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

PT-2026-98262

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...

CVE-2026-88388

Espruino 2v29 commit bffc6d0 contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker, which passes the address of a 4-byte...

PT-2026-98261

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-48543: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

PT-2026-97722

Name of the Vulnerable Software and Affected Versions PaperCut Hive embedded application for Ricoh devices affected versions not specified Description An input validation issue exists where the application fails to properly sanitize input received during the NFC card reading process before passin...

CVE-2026-48542: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing...

PT-2026-98300

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 commit bffc6d0 Description A stack-based buffer overflow exists in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can provide JavaScript input that triggers an exception, leading to the...

CVE-2026-57440: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...

PT-2026-98264

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form...

CVE-2026-91122: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-88388

Espruino 2v29 commit bffc6d0 contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker, which passes the address of a 4-byte...

PT-2026-97779

Name of the Vulnerable Software and Affected Versions Paessler PRTG Network Monitor versions prior to 26.2.120.1449 Description A reflected Cross-Site Scripting XSS issue exists where the web interface returns an HTTP 403 Forbidden Path error page when a request is made for a non-existent resourc...

PT-2026-98241

Name of the Vulnerable Software and Affected Versions EmbedVideo Extension versions prior to 4.1.0 Description When the $wgEmbedVideoRequireConsent variable is disabled, video URLs are passed into an iframe src attribute without proper sanitization. This allows an attacker to use a malformed URL ...

PT-2026-98145

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...

PT-2026-98263

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the product name...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...