CVE-2026-61825

The code16/sharp Laravel-based framework is vulnerable to stored cross-site scripting (XSS) in versions before 9.22.5 . The flaw exists within the SharpEditorFormField component, where attacker-controlled content using the data-html-content attribute can bypass HTML sanitization to preserve and e...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

cve-2026-64638-banner-poc

CVE-2026-64638 — ユニバーサルバナーのPoC WordPressの CVE-2026-64638 （wp-login.php における反射型HTMLインジェクション、striptags とKSESパーサーの差分）に対する、単一ファイル・依存関係なしのPoCジェネレーターです。自己送信型のトリガーページを生成します。被害者がファイルを開くと、ページはサイレントにインジェクションペイロードをPOSTし、被害者はバナーが描画されたターゲットのログインページに直接誘導されます。操作は不要で、ターゲット側でのJavaScriptも不要です。 認可されたセキュリティテスト専用です。...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...

markdown-exfil-tester

valtik-markdown-exfil-tester LLM ベースのチャットボットにおける、間接的プロンプトインジェクションによるマークダウン / HTML 外部送信（exfiltration） のためのブラックボックステスターです。これは、Microsoft 365 Copilot（CVE-2025-32711、通称 EchoLeak）、ChatGPT（OpenAI の 2026 年 2 月パッチ）、Salesforce（ForcedLeak）で発生した脆弱性クラスです。そのパターンは次のとおりです。 1. 攻撃者は、LLM...

CVE-2026-31281

CVE-2026-31281 説明 Totara LMS は HTLM インジェクションに対して脆弱です。攻撃者はメッセージに悪意のある HTLM コードを注入し、アプリケーション内のすべてのユーザーに送信することで、コードの実行につながり、セッションハイジャックや被害者のブラウザ上でのコマンド実行を引き起こす可能性があります。 CVSS 3 スコア: 7.3 高 攻撃タイプ リモート 認証済み 影響を受けるバージョン 19.1.5 以前のバージョン 19.1.5 発見者: Yazan Abu-Nadi...

RLSA-2026:70640 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

buildah security update

An update is available for buildah. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...

RLSA-2026:70641 Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...

skopeo security update

An update is available for skopeo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Command line utility to inspect images and repositories directly on Docker...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-61784

The xhtml-purifier Node.js library (versions prior to 0.4.3 ) contains an HTML attribute-injection vulnerability in the attributeString() function of XHTMLPurifier.js. The root cause is a failure to HTML-entity-encode attribute values during serialization, allowing an attacker to use a double-quo...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

EUVD-2026-86321

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-91119 Discourse: Encode action_code_who in mention URLs

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-91119

The open-source discussion platform Discourse is vulnerable to stored HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The small-action and nested-activity-log components fail to perform URL encoding when interpolating the free-form action_code_who value into mentio...

CVE-2026-36341

Webkul Krayin CRM にクロスサイトスクリプティング（XSS）の脆弱性（HTML インジェクション） CVE: CVE-2026-36341 概要 この脆弱性は、管理パネルに影響を及ぼすため、特に深刻です。多くの CRM ワークフローでは、管理者や上位レベルの管理者がスタッフによって記録された活動をレビューします。単純な「通話」または「会議」ログにペイロードを注入することで、攻撃者は被害者との直接的なやり取りなしに、高権限のアカウントを標的にすることができます。 PoC 1. 簡単な説明を作成します（HTML インジェクション付き） 2. 最終出力 参考情報...