PT-2026-79446

Name of the Vulnerable Software and Affected Versions Defuddle versions prior to 0.19.1 Description Site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping. Additionally, the...

PT-2026-79427

Name of the Vulnerable Software and Affected Versions DiscordChatExporter versions prior to 2.47.2 Description The VisitEmojiAsync function in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs fails to perform HTML entity encoding when interpolating emoji.Name into the alt attribute and...

CVE-2026-69229: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

PT-2026-79299

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description Insufficient escaping of a setting used as an HTML tag name in front-end output allows users with administrator access to perform a Stored Cross-Site...

CVE-2026-69237: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-77391: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

openSUSE 16 Security Update : python-pytest-html (openSUSE-SU-2026:21602-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21602-1 advisory. Changes in python-pytest-html: - Revendor browserslist to fix the following: CVE-2026-73088: unguarded for...in loop over untrusted JSON keys in...

PT-2026-79470

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3 Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an...

PT-2026-79465

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.1 Description An HTML injection flaw allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a technique where an attacker...

CVE-2026-14325: Improper Neutralization of Input During Web Page Generation

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

PT-2026-79442

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

PT-2026-80322

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

CVE-2026-69238: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

PT-2026-79471

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A remote, highly privileged attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a process where an attacker injects malicious HTML code int...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

CVE-2026-54681: Improper Neutralization of Input During Web Page Generation

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

CVE-2026-27463: Exposure of Sensitive Information to an Unauthorized Actor

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-53468: Improper Neutralization of Input During Web Page Generation

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

AZL-96924 CVE-2026-77643 affecting package xapian-core 1.4.26-2

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...

DEBIAN-CVE-2026-77643

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...