PT-2026-72026

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

SAP NetWeaver AS ABAP XSS (3721424)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3721424: - Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a...

PT-2026-77111

Name of the Vulnerable Software and Affected Versions Site Reviews versions prior to 8.2.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of other users without requiring prior authentication...

PT-2026-72104

Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description Remote authenticated attackers can execute arbitrary scripts due to cross-site scripting, a flaw where malicious scripts are injected into trusted websites. Recommendations At the momen...

CVE-2026-17209: Improper Neutralization of Input During Web Page Generation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

FreeBSD : Gitlab -- vulnerabilities (2c73b6d5-971c-11f1-bdc8-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2c73b6d5-971c-11f1-bdc8-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration...

PT-2026-71971

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

Linux Distros Unpatched Vulnerability : CVE-2026-73415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in...

CVE-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-56858 Fix Javascript regexp context tracking in html/template

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-18741

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

Cross-site Scripting (XSS)

Overview django-helpdesk is a Django-powered ticket tracker for your helpdesk Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of HTML-formatted email messages or .html/.htm file attachments in public ticket submission channels. An attacker can execute...

CVE-2026-73418 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, pghero, commercial-gitlab-rails-ee-fips, ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, commercial-gitlab-rails-ee, ruby3.2-rails, pghero-fips, gitlab-rails-ce...

CVE-2026-73531

The CVE concerns django-helpdesk prior to 2.3.3, where a stored XSS vulnerability exists via HTML attachments or HTML-formatted emails submitted through public ticket channels. The root cause is insufficient sanitization and insecure Content-Disposition handling at the attachment-serving layer, e...

xss2shell-pro

XSS2Shell PRO v4.0 — WordPress XSS→RCE Automated Testing Platf...

CVE-2026-73038

NodeBB before 4.15.0 contains a stored XSS in the renderEmoji function due to failed escaping of tag.icon.url and tag.name within ActivityPub emoji tags. Attackers can send crafted Create/Note objects to inject HTML/JS into stored post content, leading to code execution in viewers’ browsers. Impa...

CVE-2026-73038 NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into...

CVE-2026-73038 NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into...