EUVD-2026-67917

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

PT-2026-83027

CVE ID: CVE-2026-9548 Severity: MEDIUM | CVSS Score: 6.5/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. An improper neutralization of input during web page generation 'Cross-site Scripting'...

PT-2026-83025

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

CVE-2026-37710: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-73827: Improper Neutralization of Input During Web Page Generation

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-redcarpet (UTSA-2026-032342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032342 advisory. Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting...

CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-78195

CVE-2026-78195 was rejected as a duplicate of CVE-2026-78047. The underlying vulnerability is a Cross-Site Scripting (XSS) flaw in the WatchGuard Dimension Backup Historical Data feature, which allows an authenticated administrator to execute arbitrary JavaScript in another user's browser. No spe...

Security Bulletin: Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-7775)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed Cross-site Scripting security vulnerability Vulnerability Details CVEID:CVE-2026-7775 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0 , the default-on Safe import filter sanitizes HTML only for text notes but excludes the book note type. Book note content is stored unsanitized and later injected into the page via jQuery's htm...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses ip-address-9.0.5.tgz, postcss-8.4.38.tgz, postcss-8.4.48.tgz, postcss-8.5.6.tgz, requests-2.32.4-py3-none-any.whl, requests-2.32.5-py3-none-any.whl which are vulnerable to CVE-2026-42338, CVE-2026-41305, CVE-2026-25645. This bulletin...

CVE-2026-53578 Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...

MGASA-2026-0339 Updated python-django packages fix security vulnerabilities

CVE-2026-15307: Server-side file-write and request forgery via spatial lookups CVE-2026-15337: Potential denial-of-service vulnerability in checkforlanguage CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via...

Updated python-django packages fix security vulnerabilities

CVE-2026-15307: Server-side file-write and request forgery via spatial lookups CVE-2026-15337: Potential denial-of-service vulnerability in checkforlanguage CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

Silverstripe Framework: Possible XSS attack through media embed

Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. Reported by Jack Wallace from Bastion Security...