Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

GHSA-H58C-XCCX-75M3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

ai.ancf.lmos:arc-reader-html (>=0.1.1, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.104.0, <=0.120.0) +17176 more potentially affected by CVE-2026-75140 via org.jsoup:jsoup (>=1.2.3, <=1.23.1)

org.jsoup:jsoup MAVEN version =1.2.3, =0.1.1, =0.104.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.7.0, =1.7.0, =1.7.0, =2.0.0 and more Source cves: CVE-2026-75140 Source advisory: OSV:GHSA-65R4-943X-97JJ...

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

UBUNTU-CVE-2026-49825

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...

CVE-2026-49825

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...

ailingo (>=0.2.0, <=0.4.0), articulo (>=0.3.1, <=0.5.1) +153 more potentially affected by CVE-2026-49825 via lxml-html-clean (>=0.1.0, <=0.4.4)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.3.1, =0.1.19, =0.0.550, =0.70.0, =0.46.0, =0.1.0, =4.10.0, =1.0.0, =2.0.0, =0.1.0, =3.0.0, =1.0.0, =1.6.7, =2.1.1 and more Source cves: CVE-2026-49825 Source advisory: MEND:CVE-2026-49825...

CVE-2026-49825

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in "lxml.html.defs.linkattrs" were missing "xlink:href", which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean...

CVE-2022-4993

A flaw was found in HTML::FormHandler for Perl. The applyactions and adderror functions process error message text, which can be influenced by user-supplied request data, as a template. A remote attacker can exploit this by crafting malicious input, leading to unhandled exceptions that terminate...

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

DOMPurify v3.4.14

DOMPurify DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's also very simple to use and get started with. DOMPurify was started in February 2014 and, meanwhile, has reached version v3.4.14. DOMPurify runs as JavaScript and works in all modern browsers...

WordPress WP Custom HTML Pages plugin <= 0.6.2 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin WP Custom HTML Page versions = 0.6.2...

EUVD-2026-62932

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-77643: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...

CVE-2026-76020: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-80281

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

PT-2026-79129

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description A use after free issue in the DOM allows a remote attacker to execute arbitrary code inside the sandbox by inducing the user to open a crafted HTML page. Use after free is a memory...

Linux Distros Unpatched Vulnerability : CVE-2026-52854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser functi...

PT-2026-81999

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...