MSC-2026-11394

Malicious cryptocurrency wallet-drainer disguised as a JavaScript utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC values, and attempts to transfer funds to hardcoded attacker-controlled wallets across 26 chains via ethers.Wallet.sendTransactio...

CVE-2026-77682

A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form. In embed/web-process-extension/resources/js/ephyautofill.js, getSelector builds a CSS selector by directly interpolating an element's id attribut...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

SUSE CVE-2026-74936

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-74937

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

SUSE CVE-2026-74938

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

SUSE CVE-2026-74976

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-74984

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-80232

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to: - overwriting $clone allowing mutation of objects via transforms see evaluateTransformExpression - it being possible to destruct jsonata functions/lambdas e.g. $merge. - applyProcedure using...

PT-2026-79469

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.2 Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This could lead to the execution of arbitrary JavaScript within the browse...

PT-2026-79467

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This could lead to the execution of arbitrary JavaScript within the browse...

PT-2026-79451

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...

CVE-2026-77811: Improper Neutralization of Input During Web Page Generation

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...

CVE-2026-69236: Improper Neutralization of Input During Web Page Generation

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...

CVE-2026-69234: Improper Neutralization of Input During Web Page Generation

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69231: Improper Neutralization of Input During Web Page Generation

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...

CVE-2026-69232: Improper Neutralization of Input During Web Page Generation

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...

CVE-2026-75933: Improper Neutralization of Input During Web Page Generation

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

PT-2026-79485

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A reflected cross site scripting issue exists that allows a remote, unauthenticated attacker to create a crafted link. If a victim clicks this link, arbitrary JavaScript code may be...

Zabbix Server 6.0.x < 6.0.47 / 7.0.x < 7.0.27 / 7.4.x < 7.4.11 DoS (ZBX-28075)

The version of Zabbix Server installed on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.27, or 7.4.x prior to 7.4.11. It is, therefore, affected by a denial of service vulnerability: - An authenticated administrator is able to crash Zabbix server by creating specifically crafted...