CVE-2026-8833 XSS in urls

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

EUVD-2026-35053

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

CVE-2026-8833 XSS in urls

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

CVE-2026-7186

Stored cross-site scripting in the URL dashboard widget in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the...

CVE-2026-7186 Fix stored XSS in URL dashboard widget via dangerous URI schemes

Stored cross-site scripting in the URL dashboard widget in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the...

CVE-2026-11569 Quay: quay: stored xss via filedrop svg upload

A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting wh...

CVE-2026-41724

creationtimestamp| type| source ---|---|--- 2026-06-08 10:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnrgg4qvqn25 2026-06-08 10:24:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-560 2026-06-08 10:50:45+00:00| seen|...

CVE-2026-11494

creationtimestamp| type| source ---|---|--- 2026-06-08 07:00:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr4bn2rxr2o...

CVE-2021-47984

creationtimestamp| type| source ---|---|--- 2026-06-08 05:24:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqwxof6ya24...

CVE-2024-58348

creationtimestamp| type| source ---|---|--- 2026-06-08 04:55:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqvcnmdvl2r...

CVE-2021-47983

creationtimestamp| type| source ---|---|--- 2026-06-08 04:46:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqutppcwy2r...

CVE-2026-11466

creationtimestamp| type| source ---|---|--- 2026-06-08 01:06:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqijr7ejc26...

CVE-2026-11469

creationtimestamp| type| source ---|---|--- 2026-06-08 00:56:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqhxu5wkz2y...

Checkmk Cross-Site Script Vulnerability

Checkmk is an IT monitoring platform developed by Checkmk Corporation. Versions of Checkmk prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions contain a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting vulnerability within the URL...

CVE-2026-11502: URL Redirection to Untrusted Site

A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdLoginController.java of the component Third-Party Login. This manipulation of...

CVE-2026-11477: URL Redirection to Untrusted Site

A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in op...

PT-2026-47287

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p5 Checkmk versions prior to 2.4.0p31 Checkmk versions prior to 2.3.0p48 Checkmk versions 2.2.0 Description Improper neutralization of HTML-encoded characters in the URL validation function allows an authenticate...

PT-2026-47284

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p5 Checkmk versions prior to 2.4.0p31 Checkmk versions prior to 2.3.0p48 Checkmk version 2.2.0 Description Stored cross-site scripting occurs in the URL dashboard widget. A user with dashboard editing permissions...

PT-2026-47616

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description FUXA is a web-based Process Visualization software. A remote unauthenticated attacker can exploit a Server-Side Request Forgery SSRF issue where the server acts as an oracle to read data from internal o...

PT-2026-47584

Summary An unauthenticated attacker Alice connects to FUXA's Socket.IO endpoint and emits a device-webapi-request event whose property.address field names an arbitrary URL. FUXA's DEVICE WEBAPI REQUEST handler at server/runtime/index.js:296 calls axios.getaddress server-side and broadcasts the fu...