CVE-2026-78616

A Stored XSS vulnerability in WatchGuard Dimension 's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate. The CVSS 4.0 score is 4.8 (MEDIUM) , ref...

CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-81753

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753

Flowintel versions >= 3.3.0 are affected by a stored XSS vulnerability in case notes that contain Mermaid diagram blocks . Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note can store a crafted Mermaid payload that...

EUVD-2026-67009

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-73426

A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...

CVE-2026-81753: Improper Neutralization of Input During Web Page Generation

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

PT-2026-82854

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

PT-2026-82845

A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...

PT-2026-82501

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Stored Cross-Site Scripting XSS occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edi...

PT-2026-82855

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...

GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

Android App "Myna Point" vulnerable to improper access restriction

Overview Android App "Myna Point" provided by Digital Agency contains the following vulnerability. Improper Authorization in Handler for Custom URL Scheme CWE-939 - CVE-2026-73335 RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with th...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

CVE-2026-73335

Myna Point (an Android application, package jp.go.soumu.mkpf.mkpfmypage) is vulnerable to Improper Authorization (CWE-939) in its handler for a custom URL scheme . A malicious application already installed on the same device can send an Intent to the affected app, potentially causing arbitrary Ja...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...