CVE-2026-54505

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49245

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...

CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-54505

In TREK before 3.1.0, the Journey add-on interpolates an unescaped trip title into journey.frontpage.suggestionText (via TranslationContext.tsx) and renders it with dangerouslySetInnerHTML in JourneyPage.tsx. A trip owner stores HTML in a qualifying trip title; GET /api/journeys/suggestions retur...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

EUVD-2026-63694

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-64730

A flaw was found in WebKitGTK. Visiting a website that frames malicious content can cause UI spoofing due to UI issues. Mitigation Do not visit untrusted websites or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-64728

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-43804

A flaw was found in WebKitGTK. Visiting a malicious website can cause an application denial of service due to improper state management. Mitigation Do not visit untrusted websites or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK...

CVE-2026-63003

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:15+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr...

CVE-2026-64787

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process termination. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-64783

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packag...

CVE-2026-64757

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-64719

A flaw was found in WebKitGTK. Processing malicious web content can cause an out-of-bounds access issue due to improper bounds checking and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-28984

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...