CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

cPanel-CVE-2023-29489

POC for cPanel CVE-2023-29489 XSS Payload...

CVE-2026-30695

CVE-2026-30695 - XSS in Zucchetti Axess Summary A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+. The vulnerability is caused by improper sanitization of user-supplied...

EUVD-2026-107012

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

EUVD-2026-106856

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

PT-2026-120187

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

Linux Distros Unpatched Vulnerability : CVE-2026-109344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by...

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to...

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered...

PT-2026-120591

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

PT-2026-120492

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5...

Linux Distros Unpatched Vulnerability : CVE-2026-109597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted...

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

SUSE CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...