1126674 matches found
CVE-2026-78738
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...
Linux Distros Unpatched Vulnerability : CVE-2026-85630
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with field...
RHEL 9 : ignition (RHSA-2026:65336)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65336 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing fil...
ALSA-2026:65116 Important: opentelemetry-collector security update
Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...
CVE-2026-78741
Silverpeas Core versions up to 6.4.6 are affected by a Cross-Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. The flaw allows an unauthenticated remote attacker, with user interaction, to inject malicious scripts via the image upload mechanism, resulting in a chang...
PT-2026-86993
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
CVE-2026-78742
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...
PT-2026-86992
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...
CVE-2026-78738
Silverpeas Core 6.4.6 is vulnerable to Cross-Site Scripting (XSS) via the Document management file upload feature . An attacker can craft a malicious document file that, when uploaded and processed by the application, injects script executed in the context of other users' browsers. The CVSS 3.1 b...
CVE-2026-78742
Silverpeas Core versions up to and including 6.4.6 are vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction field. The flaw allows an attacker to inject malicious scripts that execute in another user's browser, with changed scope and low impact on both conf...
Microsoft Exchange Server (September 2026)
The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. CVE-2026-55007 - External control of file name...
CVE-2026-86484
JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...
CVE-2026-86431
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
EUVD-2026-72389
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
CVE-2026-86431
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and
WordPress Easy Appointments plugin <= 4.0.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by 0xzenko in WordPress Plugin Easy Appointments versions = 4.0.2.2...
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
EUVD-2026-72354
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-78325
CVE-2026-78325 is a cross-site scripting (XSS) vulnerability in the Evernote and Google Keep note importers of Standard Notes for Android through version 3.201.24 . An attacker can craft a malicious .enex or Google Keep HTML file that, when imported by a victim, executes arbitrary JavaScript in t...