CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-46492

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting XSS vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including...

EUVD-2026-33304

WWBN AVideo: Stored XSS via unescaped Gallery category description...

WWBN AVideo: Stored XSS via unescaped Gallery category description

Summary AVideo stores category descriptions from user input and later renders categorydescription as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. Th...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the categorydescription field when user-supplied input is rendered as raw HTML without proper output encoding. An attacker can execute...

Server-side Request Forgery (SSRF)

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the HTML rendering process when the...

PT-2026-46114

Name of the Vulnerable Software and Affected Versions Anti-Spam by CleanTalk versions 0.0.0 through 9.7.1 Description Reflected Cross-site Scripting XSS occurs when the module fails to sufficiently sanitize API response messages before rendering them in HTML output. Specifically, the cleantalk di...

SUSE CVE-2026-27136

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

SUSE CVE-2026-42502

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-25681)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-25681 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML...

CVE-2026-9818

CVE-2026-9818 is rejected/not used; this entry does not represent an active vulnerability.

Linux Distros Unpatched Vulnerability : CVE-2026-27136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications...

Linux Distros Unpatched Vulnerability : CVE-2026-42506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications...

AZL-87885 CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88323 CVE-2026-27136 affecting package telegraf for versions less than 1.31.0-22

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88308 CVE-2026-27136 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87483 CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87495 CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87594 CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87876 CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...