1148552 matches found
PT-2026-79311
Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...
PT-2026-79452
Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web based IT service management tool. A Reflected Cross-Site Scripting XSS issue exists in the dashboard save functionality. Reflected XSS occurs when an application includes...
Linux Distros Unpatched Vulnerability : CVE-2026-77643
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML...
PT-2026-79445
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...
PT-2026-79346
Inappropriate Encoding for Output Context vulnerability in joshnuss xml builder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...
CVE-2026-47079: Inappropriate Encoding for Output Context
Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...
CVE-2026-54681: Improper Neutralization of Input During Web Page Generation
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...
CVE-2026-55850: Improper Neutralization of Input During Web Page Generation
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...
Fedora 44 : wordpress (2026-dc0ff85b8b)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc0ff85b8b advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...
openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21593-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21593-1 advisory. Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead ...
openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21592-1 advisory. Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead...
AZL-96924 CVE-2026-77643 affecting package xapian-core 1.4.26-2
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
DEBIAN-CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
UBUNTU-CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...
CVE-2026-77643
Xapian xapian-core versions before 2.1.0 and 1.4.32 are vulnerable due to incomplete HTML escaping in Xapian::MSet::snippet() within queryparser/termgenerator_internal.cc, a missed corner case of CVE-2018-0499. This allows stored XSS when snippet output is rendered in a browser. CVSS 4.4 (MEDIUM)...
CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...