8614 matches found
CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
CVE-2026-78616
A Stored XSS vulnerability in WatchGuard Dimension 's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate. The CVSS 4.0 score is 4.8 (MEDIUM) , ref...
CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-78195
CVE-2026-78195 was rejected as a duplicate of CVE-2026-78047. The underlying vulnerability is a Cross-Site Scripting (XSS) flaw in the WatchGuard Dimension Backup Historical Data feature, which allows an authenticated administrator to execute arbitrary JavaScript in another user's browser. No spe...
CVE-2026-81753
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
CVE-2026-81753
Flowintel versions >= 3.3.0 are affected by a stored XSS vulnerability in case notes that contain Mermaid diagram blocks . Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note can store a crafted Mermaid payload that...
EUVD-2026-67009
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
CVE-2026-73426
A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...
CVE-2026-81753: Improper Neutralization of Input During Web Page Generation
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...
PT-2026-82501
Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Stored Cross-Site Scripting XSS occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edi...
PT-2026-82855
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
PT-2026-82854
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
PT-2026-82845
A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...
GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...