Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

PT-2026-97651

Name of the Vulnerable Software and Affected Versions Webform affected versions not specified Description The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting XSS, a technique where malicious scripts are injected into truste...

PT-2026-97650

Name of the Vulnerable Software and Affected Versions Drupal Contributed Module affected versions not specified Description The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting XSS, a technique where malicious scripts ar...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripti...

PT-2026-97151

Name of the Vulnerable Software and Affected Versions Fast FAC1203R Gigabit Edition version 2.0.4 Description A stack-based buffer overflow exists in the Device Discovery Service component. This issue occurs within the copy msg element function and can be triggered remotely through manipulation...

PT-2026-97532

Name of the Vulnerable Software and Affected Versions Arc affected versions not specified Description An address bar spoofing issue exists where an attacker can manipulate the browser address bar. This is achieved using a element that triggers the requestFullscreen function without displaying the...

MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...

WordPress Element Pack Addons for Elementor plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...

CVE-2026-19873

A flaw was found in HTML::FormFu for Perl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request with an unbounded repeat count to a Repeatable element. The application's process method reads the repeat count from the query string,...

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...

CVE-2026-56795

Dell Server Update Utility versions prior to 26.07.01 are affected by an Uncontrolled Search Path Element vulnerability. A low-privileged attacker with local access could exploit this to achieve code execution , with a CVSS 3.1 score of 8.2 (HIGH) and a changed scope impacting confidentiality, in...

CVE-2026-56795

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...

EUVD-2026-81691

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-66574

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66574

CVE-2026-66574 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the Element Pack Elementor Addons WordPress plugin (by BDThemes), affecting versions 8.8.3 and below . The flaw was discovered by researcher Dthangws and rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:R/...

EUVD-2026-81495

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Element Pack Elementor Addons versions = 8.8.3...