CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

Exploit for CVE-2026-39154

Wildfire CVE-2026-39154 · Stored XSS in CometChat group m...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-75002

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Chaty Pro versions = 3.5.8...

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin SSL Zen versions = 4.7.43...

CVE-2026-74800

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via REST API 'businessid' Parameter vulnerability discovered by MatilJ in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

CVE-2026-19998

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

F-RevoCRM vulnerable to cross-site scripting

Overview F-RevoCRM provided by Thinkingreed Inc. contains the following vulnerability: Cross-site scripting CWE-79 - CVE-2026-71368 Bui Minh Dang of VLC SECURITY LAB CO., LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2026-19995

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-22072

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...