CVE-2026-113442

The TYPO3 Fluid-Form by coding.ms extension (fluid_form ) is vulnerable to Cross-Site Scripting (XSS) due to a lack of input escaping. Specifically, values provided by visitors are inserted into the HTML summary email without proper sanitization. This allows an unauthenticated attacker to inject ...

EUVD-2026-104868

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

PT-2026-118315

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-4418

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-4418

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to HTML injection (CWE-80). A remotely authenticated attacker can inject malicious HTML code that executes within a victim's web browser under the hosting site's security context. This vulnerability was addressed in version 2.3.6.2 ...

CVE-2026-4418 IBM Cloud Pak System HTML Injection

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2026-104520

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

CVE-2026-4418: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-111932

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932

The Coder platform versions before 2.29.17 , 2.30.0 (before 2.32.7 ), 2.33.0 (before 2.33.8 ), and 2.34.0 (before 2.34.2 ) are vulnerable to a stored HTML injection vulnerability. The root cause is the insufficient escaping of ApplicationName and LogoURL appearance settings when rendered into HTM...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

EUVD-2026-103299

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932: Improper Neutralization of Input During Web Page Generation

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CrushFTP HTML Injection

CrushFTP before version 11.3.760 contains an HTML injection vulnerability where a shared filename is reflected unsanitized in an email body. The archive includes reproduction details...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Chromecast within Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML into a privileged page via malicious network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...