CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

WordPress Easy Appointments plugin <= 4.0.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xzenko in WordPress Plugin Easy Appointments versions = 4.0.2.2...

CVE-2026-78325

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...

CVE-2026-78325

CVE-2026-78325 is a cross-site scripting (XSS) vulnerability in the Evernote and Google Keep note importers of Standard Notes for Android through version 3.201.24 . An attacker can craft a malicious .enex or Google Keep HTML file that, when imported by a victim, executes arbitrary JavaScript in t...

EUVD-2026-72354

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

EUVD-2026-72353

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

CVE-2026-86301 code-projects Hospital Information System Patient Management editPatient.php cross site scripting

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

CVE-2026-86301 code-projects Hospital Information System Patient Management editPatient.php cross site scripting

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

WordPress IPGP Visitors Origin plugin < 1.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Vuln Seeker Cyber Security Team in WordPress Plugin IPGP Visitors Origin versions 1.6...

CVE-2026-86294

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

EUVD-2026-72342

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

Security Bulletin: IBM ApplinX is vulnerable to an Improper Neutralization of Input during web generation and Insufficient verification of data authenticity vulnerabilities due to use of Angular compiler and common-joins (CVE-2026-69151, CVE-2026-68945)

Summary IBM ApplinX is vulnerable to an Improper Neutralization of Input during web generation and Insufficient verification of data authenticity vulnerabilities due to use of Angular compiler and comma-joins CVE-2026-69151, CVE-2026-68945 The affected versions have been updated within IBM Applin...

CVE-2026-86278

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file managesubjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed fr...

CVE-2026-86278 SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file managesubjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed fr...

CVE-2026-86278 SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file managesubjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed fr...