CVE-2026-82090

Pocket for Android (versions through 8.33.0.0 ) is affected by a Cross-Site Scripting (XSS) vulnerability rated CVSS 4.0 9.2 (CRITICAL) . The root cause is that the "Save to Pocket" feature injects external HTML into the DOM, allowing injected JavaScript to alter the application state via native ...

CVE-2026-43980

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-43980

Malla , a web analyzer for Meshtastic networks based on MQTT data, is affected by a stored XSS vulnerability. Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping across multiple frontend pages (traceroute_graph....

CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-65644

Rocket.Chat versions before 8.8.0 , 8.7.1 , 8.6.2 , 8.5.3 , 8.4.6 , 8.3.8 , 8.2.8 , 8.1.8 , and 7.10.15 contain a stored HTML injection (CWE-79) in the Livechat visitor flow. The unauthenticated REST endpoint POST /api/v1/livechat/visitor accepts an unsanitized name field that is stored raw and l...

CVE-2026-54505

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-54743

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

EUVD-2026-62848

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

CVE-2026-15446

The EWWW Image Optimizer WordPress plugin (all versions up to and including 8.7.3 ) is vulnerable to Stored Cross-Site Scripting via the data-script Lazy Load attribute in post content. The root cause is insufficient input sanitization and output escaping: an attacker with contributor-level acces...

PT-2026-78678

Name of the Vulnerable Software and Affected Versions lemmy-ui versions prior to 0.19.19-beta.1 Description lemmy-ui renders Markdown for post bodies, comment bodies, private messages, and community and site sidebars through the mdToHtml function in src/shared/markdown.ts. This function returns a...

PT-2026-78642

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.3.1 Description An issue exists where the result.appendSpan function in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the...

Exploit for CVE-2026-64638

xss2shell-check Non-destructive, dependency-free detector for...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-66779

CVE-2026-66779 describes a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver Application Server ABAP. An authenticated attacker could craft a malicious link that, when opened by a victim, is reflected in the DOM on page render, enabling execution of malicious content in the victim’s b...

PT-2026-64811

Name of the Vulnerable Software and Affected Versions NoteGen versions prior to 0.32.0 Description Cross-site scripting occurs when AI chat responses are rendered using markdown-it with the html:true configuration and injected into the DOM via dangerouslySetInnerHTML in the chat-preview component...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

beets has a Cross-site Scripting vulnerability

During code logic analyis, an area that may lead to unintended behavior under specific conditions was discovered. Overview- Verified Version: 80cd21554124da07d17a4f962c7d770a4f70d0f2- Vulnerability Type: Stored XSS- Affected Location: beetsplug/web/templates/index.html:42- Trigger Scenario:...

CVE-2026-54011

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the project selector component when rendering selection menus for associating projects with system entities due to improper sanitization of project names returned via AJAX before injecting them into the DOM a...