EUVD-2026-78465

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Malicious code in csa-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...

MAL-2026-16175 Malicious code in csa-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

EUVD-2026-78314

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-91778

CVE-2026-91778 affects Octopus Server and stems from incorrect permission validation during script execution. Users holding certain scoped permission sets can execute arbitrary scripts on a worker—including the Octopus Server built-in worker—without possessing the required authorization. This is ...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

EUVD-2026-78202

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-91936: Improper Neutralization of Special Elements used in an OS Command

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

PT-2026-92056

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag version and node...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

PT-2026-91892

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description Incorrect permission validation during script execution allows users with certain scoped permission sets to execute arbitrary scripts on a worker, including the Octopus Server built-in...

ROS-20260915-73-0031

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise data integrity...

CVE-2026-76864: Improper Neutralization of Input During Web Page Generation

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...