CVE-2026-73703

CVE-2026-73703 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer . An unauthenticated adjacent attacker can inject malicious script that executes in a victim's browser within the context of the interface, requiring user in...

EUVD-2026-42425

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig routes...

CVE-2026-83607

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement function does not properl...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...

AZL-99342 CVE-2026-83607 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary serialize-javascript is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-34043. Vulnerability Details CVEID:CVE-2026-34043 DESCRIPTION: Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version...

CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-77341

A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. This vulnerability allows a remote attacker to inject arbitrary HTTP headers or split HTTP responses by sending specially crafted data within chunked response trailer headers. The library fails to properly validate these headers, enabling...

Security Bulletin: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

Summary Current security configuration lacks specific content security directives, relying on a broad fallback policy in FTM SWIFT user interfaces CVE-2025-36147. Vulnerability Details CVEID:CVE-2025-36147 DESCRIPTION: IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting...

WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Interactive Geo Maps versions = 1.6.30...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.13.1...

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Login With Ajax versions = 4.5.1...

xmlrpc-c security update

An update is available for xmlrpc-c. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XML-RPC is a remote procedure call RPC protocol that uses XML to encode its...

RLSA-2026:61316 Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

TencentOS Server 4: grafana (TSSA-2026:0947)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0947 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-1726:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1726:01 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...