CVE-2026-47665: Improper Neutralization of Input During Web Page Generation

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

PT-2026-82332

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when custom font family names are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. The backend accepts an arbitrary...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

CVE-2026-68900

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

CVE-2026-55085

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-55085

Etherpad (real-time collaborative editor) is affected by a stored cross-site scripting vulnerability prior to version 3.3.1 . The root cause is in result.appendSpan in src/static/js/domline.ts, which interpolates the start attribute of a numbered list directly into an unquoted ol start attribute ...

CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

EUVD-2026-62740

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

EUVD-2026-62710

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

Exploit for Cross-site Scripting in Prometheus

CVE-2026-40179 — Prometheus stored XSS via remotewrite A m...

PT-2026-78642

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.3.1 Description An issue exists where the result.appendSpan function in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the...

PT-2026-78653

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

GHSA-C7HR-448W-65PX MeshCentral has unsanitized data fields

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

MeshCentral has unsanitized data fields

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

PT-2026-83380

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

CVE-2026-75531

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...