CVE-2026-79311: Improper Neutralization of Input During Web Page Generation

webpy web.py 0.76 is vulnerable to Cross Site Scripting XSS via renderjinja.init...

CVE-2026-75510: Improper Neutralization of Input During Web Page Generation

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-96797

Name of the Vulnerable Software and Affected Versions web.py version 0.76 Description Cross Site Scripting XSS occurs via the render jinja. init function. Cross Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations As a...

EUVD-2026-84551

webpy web.py 0.76 is vulnerable to Cross Site Scripting XSS via renderjinja.init...

RockyLinux 9 : osbuild-composer (RLSA-2026:69293)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090055 advisory. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the erro...

CVE-2026-94426 xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3.SP2 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-88746

idccms V1.70 is vulnerable to Cross Site Scripting XSS in /admin/makeDiydeal.php...

CVE-2026-88746: Improper Neutralization of Input During Web Page Generation

idccms V1.70 is vulnerable to Cross Site Scripting XSS in /admin/makeDiydeal.php...

CVE-2026-94150: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-91921: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-94210: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...