CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...

CVE-2026-112365

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-112365 easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-112365

The easy.jobs WordPress plugin (versions up to and including 2.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'cover_letter' parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For...

CVE-2026-112365 easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-105456

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

EUVD-2026-114128

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456

The RTIR extension for Request Tracker (RT) introduces a Stored XSS vulnerability due to a flawed HTML scrubber rule. The extension allows internal link placeholders but incorrectly permits any link containing that placeholder, including those using the javascript: scheme. This change affects the...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

PT-2026-133623

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...

EUVD-2026-39473

Keycloak vulnerable to cross-site scripting xss via case-insensitive uri validation bypass...

GHSA-V3F7-2P4R-MWFW Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...

PT-2026-133252

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...

Linux Distros Unpatched Vulnerability : CVE-2026-102342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements c...

CVE-2026-102342

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

DEBIAN-CVE-2026-102342

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...