CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

[SECURITY] [DSA 6398-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6398-1 [email protected] https://www.debian.org/security/ Alberto Garcia July 23, 2026 https://www.debian.org/security/faq -...

CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-65912

DOMPurify before 3.3.2 has a URI validation bypass when ADD_ATTR is used as a predicate via EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker can craft a predicate to accept specific attribute/tag combinations, allowing unsafe protocols like javascript: to bypass validation and execute as DOM-ba...

CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...

CVE-2026-65756

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

CVE-2026-65756 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

CVE-2026-65756

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

CVE-2026-65756 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

EUVD-2026-47913

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

CVE-2026-65756

CVE-2026-65756 affects the Joomla extension Keyboard Shortcuts from regularlabs.com. The issue is an XSS vector where shortcut configuration accepts arbitrary inline JavaScript, allowing potential script execution in the context of the affected extension. Per the published metrics, the attack vec...

CVE-2026-9066

The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...

EUVD-2026-47886

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

PT-2026-63994

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

GHSA-9CMH-XCQM-5HQR n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

Impact n8n's JavaScript task runner shared one module cache across all users' Code-node executions, so a user able to run a Code node could poison a cached module and alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a...

CVE-2026-16630

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...