CVE-2026-4418

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-4418

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to HTML injection (CWE-80). A remotely authenticated attacker can inject malicious HTML code that executes within a victim's web browser under the hosting site's security context. This vulnerability was addressed in version 2.3.6.2 ...

CVE-2026-4418 IBM Cloud Pak System HTML Injection

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2026-104520

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

CVE-2026-64944 Apache Answer: Stored XSS via unsanitized HTML in imported question content

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

CVE-2026-64944

Versions of Apache Answer through 2.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the importer stores question bodies from imported data sources as raw HTML, bypassing the standard Markdown-to-HTML sanitization path. Consequently, attacker-controlled HTML ...

CVE-2022-30190

CVE-2022-30190 IMPORTANT Patched as of: June 14th 2022 Security updates CVE Report HTML file must be served to target exaple exploit.html An easy way to run the attack is by running server.py...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solution Upgrade MyBB version 1.8.34 or higher...

CVE-2006-3392

CVE-2006-3392 Description Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser's security sandbox, leading to information...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser's security sandbox, leading to information...

chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

CVE-2026-112038 diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting

A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote...