CVE-2025-13533

The CSS & JavaScript Toolbox WordPress plugin (all versions up to and including 12.0.6 ) is vulnerable to Stored Cross-Site Scripting via the Assignment Engine fields. The root cause is insufficient input sanitization and output escaping on assignment data fields including Expressions , URLs , an...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

Malicious Package

Overview link-bootes-framework-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

SUSE CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

PT-2026-95309

Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. The issue exists within the Assignment Engine...

CVE-2026-84902: Improper Neutralization of Input During Web Page Generation

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

CVE-2026-93759: Improper Control of Generation of Code

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2025-13533: Improper Neutralization of Input During Web Page Generation

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

CVE-2026-89278: Exposure of Sensitive Information to an Unauthorized Actor

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueuefrontendscripts. This makes it possible for unauthenticated attackers to...

CVE-2026-92976: Insufficient Session Expiration

A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 3 Stored XSS (CVE-2026-69236)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - A stored cross site scripting issue exists in Esri Portal for ArcGIS that may allow a remote,...

PT-2026-95348

Name of the Vulnerable Software and Affected Versions T-Systems TAO 2.0 affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the profile management functionality. An authenticated user can inject malicious HTML or JavaScript into personal data fields. This...

PT-2026-95555

Name of the Vulnerable Software and Affected Versions @file-viewer/doc versions prior to 2.3.1 msdoc-viewer versions prior to 0.2.2 Description The legacy DOC renderer fails to restrict URL schemes when emitting document-controlled hyperlink targets into generated HTML. A crafted legacy DOC file...

CVE-2026-84992: Improper Neutralization of Input During Web Page Generation

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

PT-2026-95450

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 ART versions 9.0 through 9.0.0.2 Description An issue exists where an unauthenticated attacker can embed arbitrary JavaScript code into the Web UI. This cross-site scripting XSS flaw allo...

PT-2026-95447

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 ART versions 9.0 through 9.0.0.2 Description Cross-site scripting allows users to embed arbitrary JavaScript code in the Web UI. This can alter the intended functionality of the applicati...

CVE-2026-91127: Improper Neutralization of Input During Web Page Generation

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

CVE-2026-82890: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation...

PT-2026-95558

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description The query builder fails to neutralize string-typed query criteria, passing them directly to the database as server-side JavaScript expressions. An unauthenticated party capable of influencing...

CVE-2026-93454

Aureus ERP through 1.6.0 contains a stored XSS in the Accounting plugin's Payment Term note field. The field is stored unsanitized and rendered as raw HTML, allowing any authenticated user with payment-term create permission to inject arbitrary JavaScript via the payment-terms endpoint. The paylo...