PT-2026-61733

Name of the Vulnerable Software and Affected Versions fuint Member Marketing System versions prior to 1.1 Description A Cross-Site Scripting XSS issue exists that allows a remote attacker to execute arbitrary code. The flaw is located within the ClientMessageController.java file. Recommendations...

PT-2026-61665

Name of the Vulnerable Software and Affected Versions RT versions 6.0.0 through 6.0.2 Description An authenticated user with specific permissions can inject JavaScript into user-controlled data that is rendered without proper HTML escaping. This leads to a stored Cross-Site Scripting XSS issue,...

RockyLinux 8 : nodejs:22 (RLSA-2026:41947)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

PT-2026-61662

Name of the Vulnerable Software and Affected Versions Mettle SendPortal versions prior to 3.0.2 Description A stored cross-site scripting XSS issue exists in the template management functionality. The application does not properly sanitize user-supplied input in the content parameter of the...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

CVE-2026-26483

Summary: CVE-2026-26483 affects Mettle SendPortal 3.0.1 and earlier. A stored cross-site scripting (XSS) vulnerability exists in the template management functionality where input in the content parameter of the /templates endpoint is not properly sanitized, enabling an attacker to persistently in...

PT-2026-61664

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.40 Description A stored cross-site scripting issue exists in the user registration form. This allows an unauthenticated attacker to execute arbitrary JavaScript within the browser session of an administrator,...

PT-2026-61807

Name of the Vulnerable Software and Affected Versions Astro versions 3.10.0 through 7.0.3 Description Astro fails to HTML-escape values for specific transition directives when applied to client-hydrated components. This occurs within the generateHydrateScript function, where the transition:persis...

CVE-2026-51025

Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...

CVE-2026-51025

The CVE-2026-51025 entry relates to a Cross Site Scripting (XSS) flaw in the fuint Member Marketing System <= v1.0, enabling a remote attacker to execute arbitrary code via the ClientMessageController.java file. Connected sources (EUVD-2026-46139, NVD, CVE records, and third-party trackers) co...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Medium: tomcat9

Issue Overview: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0...

Medium: tomcat

Issue Overview: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0...

Debian dsa-6391 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6391 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6391-1 [email protected] https://www.debian.org/securit...

Important: containerd

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

MAL-2026-10782 Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

CVE-2026-45138

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-45138

CVE-2026-45138 affects CI4MS (CodeIgniter 4-based CMS skeleton). Before 0.31.9.0, html_purify sanitization mutates the value by reference, but CodeIgniter’s validator uses a copy, causing sanitized text to be discarded. The Blog controller writes raw content to blog_langs and the public post temp...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...