CVE-2026-80190 Apache Allura: Stored XSS via code repositories

Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

EUVD-2026-70950

UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the...

CVE-2026-85229

Apache SkyWalking Booster UI is affected by a stored cross-site scripting (XSS) vulnerability (CWE-79) in its dashboard widgets . The issue stems from improper neutralization of input during web page generation and affects versions 10.2.0 through 10.4.0 . Notably, this is described as an incomple...

CVE-2026-85405

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may b...

CVE-2026-85406

A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be...

EUVD-2026-70876

A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be...

CVE-2026-85406

Eleveo Quality Management 9.7.0 contains a cross-site scripting (XSS) vulnerability in the Conversation Review component. The flaw allows remote exploitation with low privileges and requires user interaction, resulting in a low integrity impact (CVSS 3.1 base score 3.5 , severity LOW ). The explo...

CVE-2026-85406 Eleveo Quality Management Conversation Review cross site scripting

A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be...

CVE-2026-85405

Eleveo Call Recording Software 9.7.0 contains a cross-site scripting (XSS) vulnerability in the /callrec/roleAddAction.do endpoint. Manipulating the name/username argument allows a remote, authenticated attacker with user interaction to inject scripts, resulting in a low integrity impact. The exp...

EUVD-2026-70875

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may b...

CVE-2026-85405 Eleveo Call Recording Software roleAddAction.do cross site scripting

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may b...

CVE-2026-85382

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-70855

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

CVE-2026-85382 light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

CVE-2026-85382

A cross-site scripting (XSS) vulnerability exists in light0011 cms (identified by commits c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930), specifically in the Chapter Content Output component. The htmlspecialchars_decode function in the file App/Home/View/Defaul...

CVE-2022-35499

Trimble TM4WEB (versions up to 22.2.0 ) is vulnerable to reflected cross-site scripting (XSS) in the external bill viewer endpoint (external_bill_viewer.msw), where an arbitrary parameter appended to the URL is reflected unsanitized into JavaScript in the HTTP response. A proof-of-concept is publ...

EUVD-2026-71609

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

EUVD-2026-71610

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...