CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

EUVD-2026-104139

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

CVE-2026-112183

The MISP application is vulnerable to CSS injection in its remote event preview feature (versions

CVE-2026-112183: Improper Neutralization of Special Elements in Output Used by a Downstream Component

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity...

EUVD-2026-101591

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-103974: Improper Neutralization of Input During Web Page Generation

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-60008

"modules/markup/jupyter/jupyter.go" sets "SanitizerDisabled: true" but leaves "DisplayInIframe" and "ContentSandbox" at their zero values. It is the only renderer in the tree that turns the sanitizer off while still rendering into the main document. Within that unsanitized output it interpolates...

CVE-2026-105784

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

EUVD-2026-92871

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784

The open-source note-taking application Joplin is vulnerable to CSS injection in versions prior to 3.7.13 . The root cause is the improper handling of jsoncanvas fences, where the TextNode.tsx and FileNode.tsx components render card content using the full Markdown renderer and insert the resultin...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

PT-2026-106279

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...