CVE-2026-47877: Improper Neutralization of Input During Web Page Generation

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

AlmaLinux 8 : go-toolset:rhel8 (ALSA-2026:60305)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60305 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

PT-2026-82692

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-59281: Improper Neutralization of Input During Web Page Generation

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-81093: Server-Side Request Forgery (SSRF)

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

PT-2026-82484

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description Improper neutralization of script-related HTML tags in a web page allows Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted websites. Recommendations...

PT-2026-82566

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get html skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a...

PT-2026-82753

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

PT-2026-82396

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

PT-2026-82748

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore xss filter": 1 in frappe/desk/doctype/workspace link/workspace link.json, and sanitize content in frappe/model/base...

PT-2026-82680

Name of the Vulnerable Software and Affected Versions Trilium versions prior to 0.104.0 Description The Safe import filter fails to sanitize note titles. The GeoMap note view interpolates a marker note title into raw HTML rendered as innerHTML, which allows an attacker-supplied import archive to...

PT-2026-82720

Name of the Vulnerable Software and Affected Versions Spring Authorization Server versions 1.4.0 through 1.4.11 Spring Authorization Server versions 1.5.0 through 1.5.8 Description The default consent page renders user-controlled values without HTML entity encoding. When using the...

PT-2026-82627

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name,...

AlmaLinux 9 : golang (ALSA-2026:60304)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

CVE-2026-81820: Improper Neutralization of Input During Web Page Generation

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-15973 LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the...

GHSA-CRX4-7MMQ-J74J OpenSTAManager has HTML Injection in modules/utenti/edit.php

Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly sanitized before being rendere...

DRUPAL-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...