CVE-2026-66612: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

PT-2026-78970

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-66598: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-77643: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...

PT-2026-78977

Name of the Vulnerable Software and Affected Versions Flatastic versions 2.0 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

PT-2026-78951

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...

PT-2026-78971

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

PT-2026-78955

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

PT-2026-78966

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

PT-2026-78967

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

PT-2026-78952

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

PT-2026-78898

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-66582: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

PT-2026-78969

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

CVE-2026-59992

creationtimestamp| type| source ---|---|--- 2026-08-19 22:35:05+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4...

CVE-2026-76328

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...

CVE-2026-76327

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...

CVE-2026-76318

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could...