SUSE CVE-2026-79258

Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79262

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-82753

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

PT-2026-82396

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-81093: Server-Side Request Forgery (SSRF)

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

PT-2026-82720

Name of the Vulnerable Software and Affected Versions Spring Authorization Server versions 1.4.0 through 1.4.11 Spring Authorization Server versions 1.5.0 through 1.5.8 Description The default consent page renders user-controlled values without HTML entity encoding. When using the...

AlmaLinux 8 : go-toolset:rhel8 (ALSA-2026:60305)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60305 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

PT-2026-82484

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description Improper neutralization of script-related HTML tags in a web page allows Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted websites. Recommendations...

PT-2026-82680

Name of the Vulnerable Software and Affected Versions Trilium versions prior to 0.104.0 Description The Safe import filter fails to sanitize note titles. The GeoMap note view interpolates a marker note title into raw HTML rendered as innerHTML, which allows an attacker-supplied import archive to...

CVE-2026-59281: Improper Neutralization of Input During Web Page Generation

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-47877: Improper Neutralization of Input During Web Page Generation

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

PT-2026-82692

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

PT-2026-82566

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get html skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a...

PT-2026-82748

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore xss filter": 1 in frappe/desk/doctype/workspace link/workspace link.json, and sanitize content in frappe/model/base...

CVE-2026-59316: Improper Neutralization of Input During Web Page Generation

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

PT-2026-82627

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name,...

CVE-2026-81820: Improper Neutralization of Input During Web Page Generation

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

AlmaLinux 9 : golang (ALSA-2026:60304)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...