PT-2026-79299

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description Insufficient escaping of a setting used as an HTML tag name in front-end output allows users with administrator access to perform a Stored Cross-Site...

CVE-2026-69237: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-77391: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

PT-2026-79465

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.1 Description An HTML injection flaw allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a technique where an attacker...

CVE-2026-14325: Improper Neutralization of Input During Web Page Generation

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

Linux Distros Unpatched Vulnerability : CVE-2026-73259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using...

PT-2026-79442

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

PT-2026-80322

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

CVE-2026-69238: Improper Neutralization of Input During Web Page Generation

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-54681: Improper Neutralization of Input During Web Page Generation

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

CVE-2026-27463: Exposure of Sensitive Information to an Unauthorized Actor

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-53468: Improper Neutralization of Input During Web Page Generation

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-54682: Improper Neutralization of Input During Web Page Generation

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...

Linux Distros Unpatched Vulnerability : CVE-2026-77643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML...

openSUSE 16 Security Update : python-pytest-html (openSUSE-SU-2026:21602-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21602-1 advisory. Changes in python-pytest-html: - Revendor browserslist to fix the following: CVE-2026-73088: unguarded for...in loop over untrusted JSON keys in...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

PT-2026-79471

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A remote, highly privileged attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a process where an attacker injects malicious HTML code int...

python313-pytest-html-4.2.0-5.1 on GA media (moderate)

python313-pytest-html-4.2.0-5.1 on GA media Announcement ID: openSUSE-SU-2026:11540-1 Rating: moderate Cross-References: CVE-2026-73088 CVSS scores: CVE-2026-73088 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-73088 SUSE : 8.7...

PT-2026-79493

Name of the Vulnerable Software and Affected Versions LeafWiki versions prior to 0.10.2 Description Page titles returned by the search API can be rendered as raw HTML in the frontend. A user with editor or administrator permissions can create or modify a page title containing an HTML/JavaScript...

PT-2026-79846

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color scheme id or dark scheme id cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was render...