PT-2026-82697

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 2.0.0 through 2.0.4 Spring for GraphQL versions 1.4.0 through 1.4.6 Spring for GraphQL versions 1.1.0 through 1.3.9 Spring for GraphQL versions 1.0.0 through 1.0.7 Description The GraphiQL page loads JavaScript...

PT-2026-82842

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-47666

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-79939

Dell PowerProtect Cyber Recovery versions prior to 20.3 contain a UNIX Symbolic Link (Symlink) Following vulnerability. A low-privileged attacker with local access could exploit this to achieve script injection . NVD scores it 7.8 (High) while Dell's CNA assessment rates it 5.8 (Medium) , reflect...

EUVD-2026-66706

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed vulnerability discovered by ? in WordPress Npm suneditor versions = 3.1.3...

CVE-2026-54606

SunEditor (lightweight WYSIWYG JavaScript editor) is vulnerable to DOM-based cross-site scripting in its Embed plugin (src/plugins/modal/embed.js). Prior to version 3.1.4 , the plugin parses attacker-controlled raw embed HTML using DOMParser; when an external [removed] element follows a valid , i...

EUVD-2026-66595

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...