119564 matches found
CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...
CVE-2026-79294
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
PT-2026-95518
Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions 7.0.0 through 7.1.0 Description A reflected cross-site scripting issue exists in the Special:Ask endpoint. The application accepts a cursor query parameter for keyset pagination, which is decoded by CursorEncoder as...
Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)
The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...
Linux Distros Unpatched Vulnerability : CVE-2026-93380
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social...
Linux Distros Unpatched Vulnerability : CVE-2026-93382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...
Linux Distros Unpatched Vulnerability : CVE-2026-93385
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...
CVE-2026-79294
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
PT-2026-135989
Уязвимость компонента WebUI веб-браузеров Google Chrome и Microsoft Edge связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации и нарушить их целостность с помощью специально...
Linux Distros Unpatched Vulnerability : CVE-2026-93377
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbo...
Linux Distros Unpatched Vulnerability : CVE-2026-93379
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium...
Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 < Security 2026 Update 3 Multiple Vulnerabilities
The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, or 12.0 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in Esri Portal for ArcGIS that may under...
PT-2026-95285
Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.5 Description Stored Cross-Site Scripting occurs via the kubio/copyright Block Content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level acces...
PT-2026-95515
Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used to store and query data. The software fails to sanitize the sep variable when it is inserted into the HTML that joins tabl...
CVE-2026-79294
Moonshot AI Kimi (specifically v1.0 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the HTML artifact Preview rendering and can be delivered through the public Share view component. This vulnerability allows a remote attacker to execute arbitrary code, w...
PT-2026-95386
Name of the Vulnerable Software and Affected Versions Moonshot AI Kimi versions prior to 2026-07-18 Description A Cross Site Scripting XSS issue exists where a remote attacker can execute arbitrary code. This occurs through the HTML artifact Preview rendering within the public Share view componen...
CVE-2026-77607: Improper Neutralization of Input During Web Page Generation
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...
Linux Distros Unpatched Vulnerability : CVE-2026-93383
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...
EUVD-2026-82973
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...
Cross-site Scripting (XSS)
Overview paella-core is a Multistream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions...