CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-15371

Velociraptor's web GUI URL column type accepts arbitrary schemes (e.g., javascript:), enabling stored XSS when a victim clicks a crafted link. Root cause is lack of scheme allow-listing. CVSS 8.1 (HIGH) requires high privileges and user click. Exploitation in the wild is not reported. Advisory: h...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

PT-2026-76943

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists where the system fails to bind the authenticated principal on the gRPC transaction executor thread within the beginTransaction function. This allows authenticated users with read-on...

PT-2026-77009

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A JIT miscompilation...

PT-2026-76961

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A flaw in the script item or preprocessing JavaScript HttpRequest logic allows a Zabbix administrator to read out-of-bounds memory, which may result in a loss of confidentiality. Recommendatio...

PT-2026-77151

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link synta...

PT-2026-77222

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the loadTemplate...

PT-2026-76948

Name of the Vulnerable Software and Affected Versions ArcadeDB server versions prior to 26.8.1 Description The server fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with the awaitResponse parameter set to false, it executes...

CVE-2026-52609

A reflected cross-site scripting (XSS) vulnerability exists in reportico-web versions

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-77017

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A race condition exists in the JavaScript Engine component. A race condition is a situation whe...

CVE-2026-55839: Improper Neutralization of Input During Web Page Generation

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-45118: Improper Neutralization of Script in Attributes in a Web Page

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-45116: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verifyprofilefields only performs the specialized validation when...

CVE-2026-45115: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-73426: Improper Neutralization of Input During Web Page Generation

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...

CVE-2026-74984: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74976: Access of Resource Using Incompatible Type

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74938: Protection Mechanism Failure

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...