1148656 matches found
PT-2026-70978
Name of the Vulnerable Software and Affected Versions tablib versions prior to 3.10.0 Description A stored cross-site scripting issue exists in the HTML export functionality. Attackers can execute arbitrary JavaScript by embedding malicious payloads in dataset titles. This occurs when the export...
Debian dla-4736 : python-django-doc - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4736 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected]...
CVE-2026-73415: Improper Neutralization of Input During Web Page Generation
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...
WordPress Forminator cross-site scripting vulnerability
WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...
PT-2026-71229
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...
Gitlab -- vulnerabilities
Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE Authorizatio...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in SonicWall GMS version 9.5.1 (Build 9510.1044) and earlier versions. These flaws, categorized under CWE-79 , allow a remote attacker to execute malicious JavaScript in a user's browser. While the risk level is moderate, the ven...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
EUVD-2026-56939
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
CVE-2026-66146
Multiple Cross-Site Scripting XSS vulnerabilities were identified in GMS 9.5.1 Build 9510.1044 and earlier versions that allow a remote attacker to execute javascript script in a user's browser...
MINI-JJWX-F4GC-H8RP
Bulletin has no description...
Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs
Summary Multiple CVE's were addressed in IBM Watsonx BI Assistant for CP4D version 5.4 patch 4 Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it...
CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...
CVE-2026-71386
is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...
CVE-2026-70355
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70306
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...