209097 matches found
EUVD-2026-73938
Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-63523
CVE-2026-63523 is a stored cross-site scripting (XSS) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. The flaw stems from improper neutralization of input during web page generation, allowing an unauthenticated attacker to perform spoofi...
CVE-2026-9216
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access such as WiFi credentials to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does...
CVE-2026-70334
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-70334
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-69793
Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69624
Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...
CVE-2026-69417
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-69402
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-69356
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-64019
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...
GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...
CVE-2026-58941
A vulnerability exists in the iommu.c file where improper input validation in multiple functions can lead to an out of bounds read/write . This flaw potentially allows for local escalation of privilege without requiring additional execution privileges or user interaction. While specific version n...
CVE-2026-58941
In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-74029
In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58941
In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-55273
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-74017
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...