EUVD-2026-83880

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-91921 Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-91921 Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-91921

CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the client-side rendering engine of the 1millionbot AI Chat Platform , caused by inadequate input sanitisation. An unauthenticated remote user can trigger the issue by sending messages containing Markdown syntax and certain unsanitis...

CVE-2026-91921: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

PT-2026-96064

Name of the Vulnerable Software and Affected Versions 1millionbot AI Chat Platform affected versions not specified Description Inadequate input sanitization in the client-side rendering engine allows an unauthenticated remote user to execute Cross-Site Scripting XSS. By sending messages containin...

The vulnerability of the Skype for Business Server’s instant messaging program, related to the possibility of using client-side authentication, allows attackers to carry out spoofing attacks.

The vulnerability of the Skype for Business Server’s instant messaging program relates to the possibility of using client-side authentication. Exploiting this vulnerability could allow attackers to carry out spoofing attacks remotely...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-56829 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

PT-2026-93222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Reflected Cross-Site Scripting issue exists where an attacker can craft a malicious link. If a legitimate user interacts with this link, it may cause the user...

PT-2026-92167

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

EUVD-2026-78941

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

ROS-20260915-73-0030

The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260915-73-0201

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

ROS-20260915-73-0133

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

ROS-20260915-73-0196

The vulnerability of the Serial component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2026-75792

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

CVE-2026-75792

IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a client-side authorization bypass (CWE-285: Improper Authorization) that allows a remote authenticated attacker to view administrative user interface components . The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM)...

CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...