CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation , which can lead to HTML injection . This vulnerability may be leveraged to perform content spoofing from a trusted domain. To address this issue, users should apply HCL Digital Experience 9.5 CF238 or later. No specific exploit deta...

EUVD-2026-90498

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

PT-2026-103749

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description An HTML injection issue exists in the VCS command failure notifications. This allows an attacker to inject malicious HTML content into the notifications triggered when a Version...

PT-2026-103676

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075: Improper Neutralization of Input During Web Page Generation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

PT-2026-105076

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action code who value into mention-link href attributes without URL encoding. A quote-bearing display name cou...

CVE-2026-103266: Incorrect Authorization

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

PT-2026-103799

Name of the Vulnerable Software and Affected Versions Ghost versions 5.2.0 through 6.61.0 Description An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of conte...

PT-2026-105077

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

PT-2026-105078

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-56662: Cross-Site Request Forgery (CSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

CVE-2026-103489: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

PT-2026-103991

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

EUVD-2026-90007

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

JetBrains YouTrack versions prior to 2026.2.18991 are vulnerable to stored HTML injection . The vulnerability is triggered through the User-Agent header , allowing for the injection of malicious HTML content. The impact is categorized as Medium severity, with a CVSS score of 4.7 . Remediation is ...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...