1148745 matches found
CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...
CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...
Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in bootstrap-3.4.1.tgz client library
Summary Vulnerabilities have been identified in bootstrap-3.4.1.tgz , which is used in IBM Engineering Lifecycle Management -Engineering Workflow Management Vulnerability Details CVEID:CVE-2024-6484 DESCRIPTION: Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript i...
WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin MultiParcels Shipping For WooCommerce versions = 1.30.36...
CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...
CVE-2026-73156 cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...
CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
WordPress Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin <= 3.0.7 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.7...
WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons plugin <= 8.7.14 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...
WordPress Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator plugin <= 1.5.4 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.4...
WordPress Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin <= 2.1.14 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Pixel Gallery Addons for Elementor versions = 2.1.14...
WordPress Ultimate Post Kit Addons for Elementor plugin <= 4.2.0 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Post Kit versions = 4.2.0...
WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...
WordPress Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons plugin <= 4.4.5 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.4.5...
WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin FormGent versions = 1.9.2...
WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin UsersWP versions = 1.2.69...
CVE-2026-16974
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...
[SECURITY] [DSA 6429-1] caddy security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...
CVE-2026-66779 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP
Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the...
CVE-2026-66771
CVE-2026-66771 concerns a cross-site scripting vulnerability in SAPUI5. A key user with content-adaptation privileges can inject malicious script into persisted application changes; when another user opens the adapted app, the script runs in the victim’s browser session. The impact is limited to ...