CVE-2026-69238 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69238

CVE-2026-69238 is an HTML injection vulnerability in Esri Portal for ArcGIS (versions 11.5 and prior), specifically in the Home application . A remote, highly privileged attacker with user interaction can insert arbitrary HTML into the application. NVD scores it 4.8 MEDIUM (CVSS:3.1), while Esri'...

EUVD-2026-64132

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

CVE-2026-55850

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-54681

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

CVE-2026-35163

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...

CVE-2026-54681

DiscordChatExporter prior to 2.47.2 is vulnerable to HTML attribute injection in its HTML export functionality. The VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HT...

EUVD-2026-64048

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

EUVD-2026-64047

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...

CVE-2026-55850

Element Web (a Matrix web client) prior to 1.12.22 is vulnerable to HTML injection via the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedH...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

EUVD-2026-64046

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-35163

OctoPrint (a web interface for controlling 3D printers) is affected by a cross-site scripting (XSS) vulnerability in its Suppressed Command notification popups . The root cause is that printer-controlled payload.command and payload.message values in terminal.js are rendered via PNotify without HT...

PT-2026-79471

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A remote, highly privileged attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a process where an attacker injects malicious HTML code int...

PT-2026-79465

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

PT-2026-79470

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3 Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an...

PT-2026-79446

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

PT-2026-79493

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...