CVE-2026-75840: Comparison Using Wrong Factors

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type to access java.util.zip.ZipFile or...

CVE-2026-23935: Out-of-bounds Read

A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...

CVE-2026-73426: Improper Neutralization of Input During Web Page Generation

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...

CVE-2026-74984: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

CVE-2026-23938: Uncaught Exception

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...

CVE-2026-75843: Improper Privilege Management

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

PT-2026-77151

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link synta...

PT-2026-76963

Name of the Vulnerable Software and Affected Versions Zabbix server or proxy affected versions not specified Description An authenticated administrator can cause a denial of service by creating specifically crafted JavaScript scripts within preprocessing or script items, which results in the cras...

PT-2026-76961

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A flaw in the script item or preprocessing JavaScript HttpRequest logic allows a Zabbix administrator to read out-of-bounds memory, which may result in a loss of confidentiality. Recommendatio...

CVE-2026-52609

A reflected cross-site scripting (XSS) vulnerability exists in reportico-web versions

CVE-2026-74937: Use After Free

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74938: Protection Mechanism Failure

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74976: Access of Resource Using Incompatible Type

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-45115: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

PT-2026-76948

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75531

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

EUVD-2026-60465

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...