CVE-2026-111894

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

The software phpMyFAQ (versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure in the FaqHelper::cleanUpContent() function, which allows authenticated content authors to bypass the hostless media-host al...

EUVD-2026-103325

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CrushFTP 11.3.7_56 HTML Injection

CrushFTP versions before 11.3.757 contain a persistent HTML injection vulnerability in the Admin Panel Reports “Who Created Folder” view. An authenticated user permitted to create folders can inject HTML that is rendered when an administrator runs the report. https://packetstorm.news/download/236...

CrushFTP HTML Injection

CrushFTP before version 11.3.760 contains an HTML injection vulnerability where a shared filename is reflected unsanitized in an email body. The archive includes reproduction details...

Linux Distros Unpatched Vulnerability : CVE-2026-109780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. CVE-2026-109780 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2026-92883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

CVE-2026-111932: Improper Neutralization of Input During Web Page Generation

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

PT-2026-116465

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.1 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description Authenticated content authors can perform stored cross-site scripting by embedding iframes with data:text/html sources within FAQ or News...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-71497

Summary Vulnerability in jsoup.jar in IBM Integration Designer: CVE-2026-71497 Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a...

Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials

Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and…...

Coder cross-site scripting vulnerabilities

Versions of Coder prior to 2.29.17, 2.32.7, 2.30.0 before 2.33.0, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 have a cross-site scripting vulnerability. This vulnerability arises from ApplicationName and LogoURL settings being rendered in HTML output without proper escaping. An attacker with t...

Thorsten Rinne phpMyFAQ Cross-site Scripting Vulnerabilities

Thorsten Rinne’s phpMyFAQ versions from 3.2.1 to 4.1.9, as well as those from 4.2.0-alpha to 4.2.0-beta, have a cross-site scripting vulnerability. This vulnerability arises due to improper filtering of the data:text/html embedded in FAQ or News content. It allows for bypassing the host-based med...

CLSA-2026-1792162055 TuxCare security update for @storybook/html-vite (1 CVE)

TuxCare rebuilt @storybook/html-vite to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

SUSE CVE-2026-110916

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-100785

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100780

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100772

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

BIT-GITLAB-2026-92883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a...