CVE-2025-53837

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

EUVD-2025-210935

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-19873

A flaw was found in HTML::FormFu for Perl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request with an unbounded repeat count to a Repeatable element. The application's process method reads the repeat count from the query string,...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...

PT-2026-135989

Уязвимость компонента WebUI веб-браузеров Google Chrome и Microsoft Edge связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации и нарушить их целостность с помощью специально...

Linux Distros Unpatched Vulnerability : CVE-2026-93385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-93382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-93380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social...

Linux Distros Unpatched Vulnerability : CVE-2026-93379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 < Security 2026 Update 3 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, or 12.0 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in Esri Portal for ArcGIS that may under...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

Linux Distros Unpatched Vulnerability : CVE-2026-93377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbo...