1137720 matches found
CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
EUVD-2026-67845
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
SUSE CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...
CVE-2026-6176
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
CVE-2026-5953
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue affects Web Design: through 25082026...
CVE-2026-4378 Stored XSS in Akıllı Ticaret's E-Commerce Pack
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001...
WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin LeadConnector versions = 4.0.5...
WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin SliceWP versions = 1.2.10...
WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin Email Essentials versions = 6.0.6...
WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Tailored Tools versions = 3.0.2...
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Super Store Finder versions = 7.10...
WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.2...
CVE-2026-5953 Reflected XSS in Ceviz Informatics's Web Design
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue affects Web Design: through 25082026...
WordPress Brave plugin < 0.8.6 - Unauthenticated Reflected XSS vulnerability
Unauthenticated Reflected XSS vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Brave versions 0.8.6...
WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via Multiple Parameters vulnerability
Reflected XSS via Multiple Parameters vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.11...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization whe...
CVE-2026-9548
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...