BIT-RABBITMQ-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

BIT-DISCOURSE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

BIT-DISCOURSE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

BIT-DISCOURSE-2026-91119 Discourse: Encode action_code_who in mention URLs

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103489

In JetBrains YouTrack versions prior to 2026.2.19422 , an HTML injection vulnerability exists within VCS command failure notifications . This flaw allows for the improper neutralization of input during web page generation (CWE-79). While the vulnerability is present, no specific exploit details o...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

EUVD-2026-90580

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation , which can lead to HTML injection . This vulnerability may be leveraged to perform content spoofing from a trusted domain. To address this issue, users should apply HCL Digital Experience 9.5 CF238 or later. No specific exploit deta...

EUVD-2026-90498

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

PT-2026-103676

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-103489: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-56662: Cross-Site Request Forgery (CSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

CVE-2026-103266: Incorrect Authorization

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

CVE-2026-67075: Improper Neutralization of Input During Web Page Generation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

PT-2026-105076

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action code who value into mention-link href attributes without URL encoding. A quote-bearing display name cou...

PT-2026-103799

Name of the Vulnerable Software and Affected Versions Ghost versions 5.2.0 through 6.61.0 Description An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of conte...