CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-18361

The CVE-2026-18361 entry affects the IRIS web application (version 2.4.26, possibly others) and is due to a stored XSS vulnerability in the datastore upload function. The reported impact is high (CVSS 3.1: 7.6), with user interaction required and a changed scope. The documents do not provide expl...

EUVD-2026-51071

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

EUVD-2026-51070

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-18360 DFIR-IRIS Stored XSS in Custom Attributes

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-18360

The CVE-2026-18360 entry describes a stored XSS in the IRIS web application (version ~2.4.26 and possibly others) specifically in the custom attributes function. The vulnerability is characterized by CVSS v3.1 metrics: Network attack vector, Low attack complexity, Privileges required Low, User in...

EUVD-2026-51069

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969

Affected product: IRIS web application (version 2.4.26 and possibly others). Vulnerability: Stored cross-site scripting (XSS) in the assets function. Impact: High (CVE-2026-16969, CVSS v3.1 base score 7.6) with confidentiality impact elevated; requires user interaction and has network access with...

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

CVE-2026-13344

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has addressed several vulnerabilities in GitLab, particularly in versions prior to 19.0.5, 19.1.3, and 19.2.1, including those of the GitLab Enterprise Edition EE. These vulnerabilities concern various aspects of GitLab: - Improper access control, allowing authenticated users to acces...

CVE-2026-13344

The CVE concerns the Essential Addons for Elementor WordPress plugin: versions before 6.6.10 are vulnerable. The bug is in the Pricing Table widget title; the HTML tag name is not validated before output, enabling Stored XSS via the title for users with Contributor-level access and above. When an...

CVE-2026-14239

CVE-2026-14239 : The Tourmaster WordPress plugin prior to 5.4.8 is vulnerable to stored XSS via CSRF. It does not perform a nonce check when storing a custom-filter label from a request parameter, and it does not escape that label when echoing it on the filter admin page. This allows an unauthent...

EUVD-2026-51011

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

EUVD-2026-51014

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

EUVD-2026-51010

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...