EUVD-2026-125611

DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the classfilter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script withou...

CVE-2026-129155

DjangoBlog versions 2.0.0.0 through 2.1.0.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the class_filter comment sanitizer fails to strip event-handler attributes from span, div, pre, and code tags. This allows authenticated commenters to post malic...

CVE-2026-105796 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text...

PT-2026-106753

Name of the Vulnerable Software and Affected Versions Kiota versions 0.5.0 through 1.34.1 Description Kiota is an OpenAPI based HTTP Client code generator. The Java and PHP documentation-comment sanitizers delete block-comment terminators instead of neutralizing them. This allows overlapping...