1126676 matches found
EUVD-2026-42425
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig routes...
CVE-2026-83607
A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement function does not properl...
CVE-2026-83605
A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...
AZL-99342 CVE-2026-83607 affecting package python-tensorboard 2.16.2-6
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.
Summary serialize-javascript is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-34043. Vulnerability Details CVEID:CVE-2026-34043 DESCRIPTION: Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version...
CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
Security Bulletin: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.
Summary Current security configuration lacks specific content security directives, relying on a broad fallback policy in FTM SWIFT user interfaces CVE-2025-36147. Vulnerability Details CVEID:CVE-2025-36147 DESCRIPTION: IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting...
WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Interactive Geo Maps versions = 1.6.30...
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.13.1...
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Login With Ajax versions = 4.5.1...
Important: Red Hat Security Advisory: golang security update
An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-1726:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1726:01 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...
RHEL 10 : golang (RHSA-2026:61882)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61882 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servi...
openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21705-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21705-1 advisory. Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: -...
CVE-2026-82221
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...