PT-2026-71508

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

PT-2026-71534

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

PT-2026-76573

Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...

PT-2026-71684

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

PT-2026-71548

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

CVE-2026-19744: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

SUSE SLED15: libxmlrpc++8 / libxmlrpc3 / libxmlrpc_abyss++8 / libxmlrpc_abyss3 / etc (SUSE-SU-2026:3572-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3572-1 advisory. This update for xmlrpc-c fixes the following issue: - CVE-2026-15928: reflected cross-site scripting XSS via HTML...

CVE-2026-28158: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

PT-2026-76434

These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed...

Cross-site Scripting (XSS)

Overview @jupyterlab/imageviewer is a JupyterLab - Image Widget Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ImageViewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted SVG image in the image viewer...

DEBIAN-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

UBUNTU-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

[SECURITY] [DLA 4736-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 12, 2026 https://wiki.debian.org/LTS -...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

EUVD-2026-57622

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...