CVE-2026-66358

acmailer has a cross-site scripting (XSS) vulnerability allowing an unauthenticated remote attacker to inject arbitrary script. CVSS 3.0 scores it MEDIUM (6.1) with user interaction required. No in-the-wild exploitation or specific affected versions are reported; monitor vendor advisories for pat...

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

EUVD-2026-62212

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

PT-2026-78383

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf and movePathTo functions located in app/src/util/pathName.ts used by the 'move/link to' path-selection dialogs...

PT-2026-78330

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

PT-2026-78382

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the '' block-reference autocomplete hint popup. The function genHintItemHTML app/src/protyle/hint/extend.ts concatenates a candidate block's name, alias, and mem...

PT-2026-78724

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.13 Description An unauthenticated user can execute unauthorized JavaScript...

PT-2026-78754

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

PT-2026-78268

Name of the Vulnerable Software and Affected Versions acmailer affected versions not specified Description A cross-site scripting XSS issue exists, which may allow an attacker to execute an arbitrary script. Cross-site scripting is a type of security flaw where malicious scripts are injected into...

PT-2026-78759

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user int...

ROS-20260819-73-0048

The vulnerability in Tomcat10 relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

PT-2026-78286

Name of the Vulnerable Software and Affected Versions Simple File List WordPress plugin versions prior to 6.3.12 Description Stored Cross-Site Scripting XSS occurs when the plugin fails to properly sanitize and escape a file's description before displaying it on the public file list. When front-e...

PT-2026-78642

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.3.1 Description An issue exists where the result.appendSpan function in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the...

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

PT-2026-78757

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user int...

PT-2026-78375

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Input During Web Page Generation, known as Cross-site Scripting XSS, allows a low privileged attacker with remote access to potentially cause...

ROS-20260819-73-0047

The vulnerability in Tomcat relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...