CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

jsoup: Cleaner may expose markup with custom raw-text elements

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup...

GHSA-PMHH-3W7G-XQP8 jsoup: Cleaner may expose markup with custom raw-text elements

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup...

CVE-2026-71497

CVE-2026-71497 affects the jsoup Java HTML parser. From 1.14.3 up to 1.23.1, the parser could mis-handle a malformed tag name ending in a control character, causing the tag to adopt the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this mispars...

CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-19110

DataGear up to 5.0.0 contains a stored cross-site scripting issue in the function HtmlTplDashboardWidgetHtmlRenderer of HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler. The vulnerability is triggered by manipulation of the Title argument, allowing remote initiation of the at...

CVE-2026-19110 DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

Summary The AttributesExtension's href/src unsafe-link filter AttributesHelper::filterAttributes can be bypassed by embedding control bytes in a javascript: URL that browsers discard before parsing the scheme. Two variants: - Tab/newline inside the scheme — a literal ASCII TAB 0x09, CR 0x0D, or...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502

CTI-Transmute is impacted by an unauthenticated stored XSS via Vue template expression injection. The vulnerability arises from insufficient neutralization of Vue {{…}} / [[…]] delimiters in server-rendered user-controlled data (e.g., public conversion names/descriptions; possible user profile na...

Silverstripe: XSS in breadcrumbs in page list view

Impact Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view Reporter Fase Rais Baradika...

CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

CVE-2026-54717 Silverstripe: XSS in breadcrumbs in page list view

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...