EUVD-2026-96304

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

PT-2026-109636

Name of the Vulnerable Software and Affected Versions @progress/kendo-react-charts versions 1.1.0 through 16.1.x Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileges who can...

CVE-2026-106138: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

BIT-GHOST-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

CVE-2026-107393

Prior to version 1.8.235 , FreeScout (a self-hosted help desk) is vulnerable to Stored HTML Injection when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. Th...

CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-105831

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105831

EspoCRM versions before 10.0.6 are vulnerable to an unauthenticated stored HTML injection vulnerability. An attacker can submit crafted data via a Lead Capture public form , which is stored in LeadCaptureLogRecord.data . When an administrator views the log record, the request body is rendered une...

CVE-2026-105831 EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105831 EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

EUVD-2026-95018

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-89290

The eimzamip application by İzometri IT Services Domestic and Foreign Trade Co. Ltd. is vulnerable to Stored XSS (CWE-80) due to improper neutralization of script-related HTML tags. This vulnerability affects versions from v1.6.4 before v1.6.7 . The impact is categorized as a low-severity HTML In...

SUSE-SU-2026:4583-1 Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: mgr-push: - Version 5.2.5-0 Remove token based authentication mechanism for packagepush bsc1230949 spacecmd: - Version 5.2.10-0 Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 - Version 5.2.9-0 Update...

CVE-2026-105831: Improper Neutralization of Input During Web Page Generation

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

PT-2026-107990

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

GHSA-5M6H-8G35-P3M7 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

WordPress MetForm plugin < 4.3.1 - Unauthenticated HTML Injection in Notification Emails vulnerability

Unauthenticated HTML Injection in Notification Emails vulnerability discovered by vuxvinh in WordPress Plugin Metform versions 4.3.1...

CVE-2026-86833 MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...