CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-12982

The Document Gallery WordPress plugin (before 5.1.1) is affected by a Reflected XSS in an unauthenticated AJAX action (dg_generate_gallery) caused by improper sanitisation/escaping of user input. Impact is XSS for unauthenticated users; remediation is to update to 5.1.1 or later (as stated in CVE...

AZL-94010 CVE-2026-15928 affecting package xmlrpc-c 1.60.04-4

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

Linux Distros Unpatched Vulnerability : CVE-2026-66010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to...

Linux Distros Unpatched Vulnerability : CVE-2026-65912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck...

Linux Distros Unpatched Vulnerability : CVE-2026-65914

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like...

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

GHSA-VQXV-6XRH-49CP OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

CVE-2026-57530

Milkdown (versions

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +271 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@burger-editor/blocks (>=4.0.0-alpha.1, <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1, <=4.0.0-alpha.7) +4 more potentially affected by CVE-2026-73428 via trix (>=2.0.8, <=2.1.15)

trix NPM version =2.0.8, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: CVE-2026-73428 Source advisory: OSV:GHSA-53G2-MVCC-Q9X3...

Cross-site Scripting (XSS)

Overview org.webjars.npm:trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLParser process. An attacker can inject malicious scripts by pasting crafted HTML containing a span element with an empty data-trix-attachment attribute,...

GHSA-53G2-MVCC-Q9X3 Trix: Stored XSS via HTMLParser attribute injection on paste

Impact The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a carrying an empty data-trix-attachment="". The empty attachment object caused the element to bypass attachment handling, so its...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

UBUNTU-CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-15648

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...