EUVD-2026-64048

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

EUVD-2026-64047

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850

Element Web (a Matrix web client) prior to 1.12.22 is vulnerable to HTML injection via the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedH...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

EUVD-2026-64046

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-35163

OctoPrint (a web interface for controlling 3D printers) is affected by a cross-site scripting (XSS) vulnerability in its Suppressed Command notification popups . The root cause is that printer-controlled payload.command and payload.message values in terminal.js are rendered via PNotify without HT...

CVE-2026-54682: Improper Neutralization of Input During Web Page Generation

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...

PT-2026-79446

Name of the Vulnerable Software and Affected Versions Defuddle versions prior to 0.19.1 Description Site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping. Additionally, the...

PT-2026-79427

Name of the Vulnerable Software and Affected Versions DiscordChatExporter versions prior to 2.47.2 Description The VisitEmojiAsync function in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs fails to perform HTML entity encoding when interpolating emoji.Name into the alt attribute and...

CVE-2026-69229: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

CVE-2026-69238: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69237: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-54681: Improper Neutralization of Input During Web Page Generation

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

PT-2026-79846

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color scheme id or dark scheme id cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was render...

PT-2026-79470

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3 Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

PT-2026-79493

Name of the Vulnerable Software and Affected Versions LeafWiki versions prior to 0.10.2 Description Page titles returned by the search API can be rendered as raw HTML in the frontend. A user with editor or administrator permissions can create or modify a page title containing an HTML/JavaScript...

PT-2026-79471

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A remote, highly privileged attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a process where an attacker injects malicious HTML code int...