djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, class, id, width, and height from the...

CVE-2026-56731

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-56731

The open-source helpdesk system Zammad is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 7.0.1 . A low-privilege authenticated user can inject arbitrary HTML markup , including JavaScript event handlers , into a ticket title through the standard ticket creation workflow. Thi...

EUVD-2026-87216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-18320

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in the article body sanitization component. The root cause is a sanitize-html configuration that uses a wildcard attribute rule, permitting all attributes on SVG and PATH elements. This allows scri...

EUVD-2026-87231

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-18320 CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

SUSE CVE-2026-92498

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

AZL-102903 CVE-2026-92498 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498 wifi: ath6kl: avoid buffer overreads in WMI event handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498

This vulnerability affects the Linux kernel 's ath6kl (Atheros 6K) wireless driver. Three WMI event handlers—ath6kl_wmi_scan_complete_rx() , ath6kl_wmi_addba_req_event_rx() , and ath6kl_wmi_delba_req_event_rx() —read from the event buffer without first verifying that the message is large enough t...

CVE-2026-92498 wifi: ath6kl: avoid buffer overreads in WMI event handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

EUVD-2026-82119

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-61592

djust is a reactive server-side rendering library for Django providing Phoenix LiveView-style functionality with Rust-powered performance. Prior to version 1.0.7 , its SSE (Server-Sent Events) transport keyed sessions solely by a client-chosen session_id with no binding to the authenticated user ...

EUVD-2026-81301

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...