EUVD-2026-88140

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

CVE-2026-91204

The documents provide conflicting information regarding CVE-2026-91204 . The Initial document describes a Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 , where an anonymous remote attacker can store a comment containing a javascript: URI. This occurs specifically when users.comm...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

EUVD-2026-88126

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-100751

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

EUVD-2026-88105

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

CVE-2026-100751

The Joomla Extension - regularlabs.com - Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 are vulnerable to Privileged stored XSS via data-rlta-url attributes. The component accepts a url option for an item and writes it to a generated attribute, which the browser subsequently passes to window.open...

CVE-2026-91204: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

Joern 4.0.640

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-73641: Improper Neutralization of Input During Web Page Generation

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

CVE-2026-82381: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

PT-2026-99851

Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-06-28 Description A Deserialization of Untrusted Data issue in the JavaScript Task on Google Cloud Platform allows an authenticated user with standard permissions to execute arbitrary...

PT-2026-99801

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Improper neutralization of input during web page generation leads to stored cross-site scripting XSS in the authoring UI. A user with authoring rights can store crafted content that is subsequently writt...

PT-2026-102395

Name of the Vulnerable Software and Affected Versions httpdbg versions prior to 2.2.1 Description The web interface fails to validate URL schemes in recorded HTTP request URLs that are rendered as clickable links. An attacker who can control the recorded traffic can provide URLs using the...

CVE-2026-102333: Improper Neutralization of Input During Web Page Generation

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

PT-2026-99887

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...