CVE-2020-12625

CVE-2020-12625: Cross-Site Scripting via Malicious HTML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. By leveraging the "" XML element in a mail with a "text/html" attachment, an attacker can bypass the...

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin (versions up to and including 2.5.7 ) is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin lacks authorization checks on several state-changing operations. Furthermore, a secret comparison mechanism can be bypassed on ...

EUVD-2026-96771

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile or precompile allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the...

CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template...

PT-2026-109314

Name of the Vulnerable Software and Affected Versions @tinacms/cli versions prior to 3.0.0 Description @tinacms/cli fails to properly escape or encode Git branch values read from VERCEL GIT COMMIT REF, GITHUB BRANCH, or HEAD. These raw values are incorporated into the API URL and interpolated int...

Server-Side Template Injection

Handlebars is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of prototype-access restrictions in lookupProperty, which allows an attacker to bypass the deny list, access the Function constructor through a controlled template, and execute...

CVE-2026-14990

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-13258

IBM DataPower Gateway is vulnerable to a cross-site scripting (XSS) flaw (CWE-79) in its Web UI. This vulnerability allows an authenticated user to embed arbitrary JavaScript code, which can alter functionality and potentially lead to credentials disclosure within a trusted session. Affected vers...

CVE-2026-13258 IBM DataPower Gateway Cross-Site Scripting

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-14990: Improper Neutralization of Input During Web Page Generation

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-107797: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-102258

A post-authentication Stored Cross-Site Scripting (XSS) vulnerability exists in the SonicWall SMA1000 appliance's Management Console (AMC) . Under specific conditions, a remote authenticated attacker with administrator privileges can store and execute arbitrary JavaScript code within the AMC. Thi...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...