EUVD-2026-67403

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

EUVD-2026-67348

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-76053

TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.3.3 . The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser: WordPress's comment KSES...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

towaos-lab-cve-2020-11023

CVE-2020-11023 - Vulnerabilidade XSS no jQuery Payloads de ataque root@kitploit: alert1 root@kitploit: Medidas de mitigação ⚠️ Importante : o uso de .html não é totalmente evitado apenas com jQuery 1. Usar o método .text ⭐️Recomendado root@kitploit: // Seguro: não é interpretado como HTML...

CVE-2026-82072

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-82072

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

WS-2026-0036

Multiple legacy PHP template files in LibreNMS output SNMP-sourced and syslog-sourced data into HTML without escaping. The syslog program field is emitted unescaped in includes/html/print-syslog.inc.php while the adjacent msg field is escaped, so an attacker who controls a monitored network devic...

PT-2026-83274

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2026-76798: Improper Neutralization of Input During Web Page Generation

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-78047: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-82072: Out-of-bounds Read

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-82072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

PT-2026-83276

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

PT-2026-82865

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-76053: Improper Neutralization of Input During Web Page Generation

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

WS-2026-0037

The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an...

PT-2026-83248

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.9.4 Description A Reflected Cross-Site Scripting XSS issue exists where the application reflects the redirect uri parameter from the 'GET /auth/authorize' endpoint into the authorize.html template without adequate HTM...

openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21635-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21635-1 advisory. - CVE-2026-56365: memory leak in the PNG encoder when writing MNG images bsc1270004. - CVE-2026-62343: heap buffer overwrite in morphology...