EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82242

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

CVE-2026-47665: Improper Neutralization of Input During Web Page Generation

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2025-70340: Improper Access Control

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hibernate-validator (UTSA-2026-093189)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093189 advisory. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

CVE-2026-38472

A Stored XSS vulnerability exists in the GazellePW (GazellePosterWall) forum reward comments (commit 86c4bedf727691b5a97af42a4864869d18446449 ). Remote attackers can inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf. This input is subsequently rendered in the data-...

PT-2026-81871

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax get jf which is later rendered in the data-tooltip attribute in...

CVE-2026-79660: Exposure of Sensitive Information to an Unauthorized Actor

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

Dotnetnuke < 10.3.3 Unauthorized comments on private journal posts (GHSA-86mr-4mmw-j9g2)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - An authorization vulnerability in the Journal module could allow an authenticated user to add comments to private journal posts...

CVE-2026-50290 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-76612

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

CVE-2026-76612 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

EUVD-2026-63940

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

CVE-2026-50290: Improper Neutralization of Input During Web Page Generation

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...