CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

EUVD-2026-92538

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-102426

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dcfilter request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then...

CirCarLife Auth Bypass (CVE-2018-16670)

Exploits CVE-2018-16670 in CirCarLife 4.3: unauthenticated access to /html/devstat.html and /services/user/values.xml exposes PLC status data. !/usr/bin/env python3 -- coding: utf-8 -- """CirCarLife devstat auth bypass CVE-2018-16670.""" from kittysploit import from lib.protocols.http.httpclient...

Astra Linux – Vulnerability in Chromium

Before version 94.0.4606.54, using "after free" in WebGPU with Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Important: Red Hat Security Advisory: rhc-worker-script security update

An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issue: CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:4445-1 Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199...

PT-2026-106058

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...

CVE-2026-105749: Uncontrolled Resource Consumption

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/htmlbackend.py, docling/backend/jatsbackend.py, and...

PT-2026-106185

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0 Description Ghost, a Node.js content management system, allows staff users, including those with Contributor roles, to host arbitrary HTML on the site domain. This occurs when creating a bookmark card, as t...

CVE-2026-105651: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

PT-2026-106245

Name of the Vulnerable Software and Affected Versions Docling versions 2.95.0 through 2.131.0 Description The HTML image resource loader in docling/backend/utils/image resource loader.py forwards headers configured via the HTMLBackendOptions.headers setting to every remote image URL specified by ...

Security Vulnerabilities fixed in Firefox for iOS 157.1 — Mozilla

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. Firefox for iOS could autofill saved credentials into a ne...