CVE-2025-61682

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...

CVE-2025-61682

Semantic MediaWiki , a free open-source extension to MediaWiki, is vulnerable to stored XSS through wikitext in versions 3.1.0 through 6.x (prior to 7.0.0). The root cause is the insertion of the unsanitized value of a data attribute into the DOM as HTML, enabling attackers to inject malicious sc...

CVE-2026-90118

CVE-2026-90118 is an off-by-one page overflow in the Linux kernel's NTFS filesystem driver, specifically in ntfs_decompress(). The per-token range check tests dp_addr > dp_sb_end instead of dp_addr >= dp_sb_end, allowing one byte to be written past the destination page. Because NTFS_SB_SIZE...

EUVD-2026-81711

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-55692

The EmbedVideo Extension (a MediaWiki extension by StarCitizenWiki) prior to 4.1.0 is vulnerable to stored XSS via the data-mw-iframeconfig attribute. When the default $wgEmbedVideoRequireConsent setting is enabled, EmbedHtmlFormatter.php embeds JSON from AbstractEmbedService.php into an HTML att...

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

PT-2026-83077

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Do not report a BUG when INLINEDATAFL lacks the system.data xattr attribute. A syzbot fuzed image triggered a BUG in ext4updateinlinedata, when an inode had the INLINEDATAFL flag set but lacked the system.data extended...

PT-2026-80982

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the nam...

GHSA-C8QC-WF67-342W Snipe-IT: Stored DOM XSS via table selected-count IDs

Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded...

EUVD-2026-62734

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

EUVD-2026-60825

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...

GHSA-2JP7-WWPG-3P9W Etherpad has stored XSS in HTML export via unescaped attribute-pool values

Fix: PR 7905 ether/etherpad. getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-="" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a craft...

CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

CVE-2026-66843

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...