SAP Business One Resource Management XSS

The vulnerability of SAP Business One’s resource management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2026-90604: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

PT-2026-91094

Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

RHEL 9 : delve (RHSA-2026:67313)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67313 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

CVE-2026-86898: Improper Neutralization of Input During Web Page Generation

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...

About the security content of Safari 27

Download JSON About the security content of Safari 27 This document describes the security content of Safari 27. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

CVE-2026-90602

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90604

A cross-site scripting (XSS) flaw exists in the Anchor Tag Handler component of the Totolink A3002MU router running firmware Hh-B20211125.1046 . The vulnerability is remotely exploitable and requires low privileges plus user interaction. A proof-of-concept exploit has been released to the public ...

CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90602

A cross-site scripting (XSS) vulnerability affects the renderHistory function in ImageStudio.js within the Studio Components component of Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0). The attack can be initiated remotely and requires low privileges and user interaction , resulting...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90583

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90583

A cross-site scripting (XSS) flaw exists in kagisearch smallweb (up to commit 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf) in the index function of app/sw.py within the Query String Rendering component. Manipulating the qs argument injects untrusted content into the rendered page. Exploitation requi...

CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90571

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2026-90569

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemall-vue/src/views/items/topic/index.vue of the component Admin Topic Handler. This manipulation causes cross site scripting. The attack may ...