CVE-2026-18131

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a cross-site scripting (XSS) flaw due to the improper neutralization of HTML input (CWE-79). This vulnerability could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser. The impac...

PT-2026-96722

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript arra...

PT-2026-97088

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper neutralization of HTML input allows a remote attacker to execute arbitrary JavaScript within the browser of an authenticated user...

PT-2026-96721

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A reflected cross-site scripting XSS issue exists in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to...

EUVD-2026-83994

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS. Improper neutralization of the referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msginfo...

CVE-2026-82890

IBM Guardium Data Protection 12.2 is vulnerable to improper neutralization of input during web page generation , allowing a remote authenticated attacker to execute arbitrary JavaScript code . The CVSS 3.1 score is 5.9 (MEDIUM) , with high attack complexity and low privileges required. No specifi...

CVE-2026-82890: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation...

PT-2026-95348

Name of the Vulnerable Software and Affected Versions T-Systems TAO 2.0 affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the profile management functionality. An authenticated user can inject malicious HTML or JavaScript into personal data fields. This...

CVE-2026-76154

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-60595

Grav: Stored XSS via Markdown audio/video media URL...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the requireImpl process. An attacker can execute arbitrary JavaScript code outside the intended sandbox by supplying...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

EUVD-2021-34881

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2021-3030: Improper Neutralization of Input During Web Page Generation

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2026-54521: Improper Neutralization of Input During Web Page Generation

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowliste...

CVE-2026-92948: Protection Mechanism Failure

vm2 versions = 3.9.6 and = 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin e.g. require: builtin: 'node:test' . On Node.js 24+, module.builtinModules exposes the scheme-only ke...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

Astra Linux – Vulnerability in WebKit2GTK

A validation issue has been addressed through improved input sanitization. This issue is fixed in iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, and macOS Monterey 12.2. Processing a maliciously crafted email message may result in the execution of arbitrary JavaScript code...

Astra Linux – Vulnerability in Firefox and Thunderbird

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution within the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...