CVE-2026-88869 AVideo AD_Server Stored XSS via log.php label parameter

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...

CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...

CVE-2026-88869 AVideo AD_Server Stored XSS via log.php label parameter

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

EUVD-2026-75397

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

Malicious code in exoplanetology-extremophile-html-webpack-plugin-webdriver-mocha (npm)

The package exoplanetology-extremophile-html-webpack-plugin-webdriver-mocha was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in event-html-webpack-plugin-json-sqlite (npm)

Source: amazon-inspector 875e00bfa3e1b4edd4e8060b916a67fb8cd83337e82e497bc92c17e79e411199 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eslint-html-webpack-plugin-eslint-plugin-auth0 (npm)

Source: amazon-inspector 38b16fcf80a6746829e48a782bf7568ffbfc1b880338831e4f8a84ff7192a83d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in equinox-terser-webpack-plugin-dione-html-webpack-plugin (npm)

Source: amazon-inspector 7b5d0a52fb179fed091ca0bfd6b0a8636b4182eb536376574927473e64771fde This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in equinox-child-process-html-webpack-plugin-frontend (npm)

The package equinox-child-process-html-webpack-plugin-frontend was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in epigenetics-html-webpack-plugin-magellan-augmentedreality (npm)

Source: amazon-inspector 1f6c9882b83d8b10007849602bbaec37bc9e44e101c89b209ee5a1081ef157b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in epimetheus-html-webpack-plugin-markdown-style-loader (npm)

The package epimetheus-html-webpack-plugin-markdown-style-loader was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in element-ui-winston-html-webpack-plugin-npm (npm)

Source: amazon-inspector 533d17b064934bf10be2328e4f60324b7af8f0958bb35f3d23e89346174c51ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...