CVE-2026-14856-TastyIgniter

CVE-2026-14856: XSS persistente verso Account Takeover in TastyIgniter v4.3.0 📌 Sommario È stata identificata una vulnerabilità di Cross-Site Scripting XSS persistente nella funzionalità di caricamento file del Media Manager in TastyIgniter v4.3.0. A causa di una validazione e sanificazione...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...