CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

CVE-2026-101270

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270

The software is vulnerable to HTML injection , where malicious HTML content can be injected into the help texts of various fields. This vulnerability is accessible to users with organizer permissions . No specific affected product versions or remediation steps are provided in the documents.

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

EUVD-2026-88752

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270: Improper Neutralization of Input During Web Page Generation

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

PT-2026-102518

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-82326

The Enocta Platform by Enocta Educational Technologies Inc. is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the vulnerability allows for XSS targeting HTML attributes . The impact is categorized as LOW for integr...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752

A cross-site scripting (XSS) vulnerability exists in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis due to improper neutralization of input during web page generation. This flaw specifically allows XSS Targeting HTML Attributes . The vulnerability affects versions f...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

EUVD-2026-87735

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100641

SiYuan versions before v3.8.4 are vulnerable to a Stored XSS flaw because they fail to HTML-escape stored flashcard block content. Specifically, content retrieved from the /api/riff/getRiffCards endpoint is inserted into app/src/card/viewCards.ts and assigned to listElement.innerHTML without prop...

CVE-2026-100639

SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...

CVE-2026-92411

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...