EUVD-2026-89964

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...

CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...

OESA-2026-4168 python-jupyterlab security update

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab before 4.5.9...

CVE-2026-103321

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321

MISP versions prior to the fix (applied after v2.5.48 ) are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability in the event graph preview feature. The root cause is a lack of server-side validation for the preview image field; the application renders this stored value into an HTML im...

EUVD-2026-89800

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-102459

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-102459

The EasyFlow .NET software developed by Digiwin is vulnerable to a Reflected Cross-site Scripting (XSS) vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript code within a user's browser by leveraging phishing attacks . No specific technical root cause, affected version...

CVE-2026-102459 DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

EUVD-2026-89715

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

Malicious code in contoso-login-sim-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ce76699c91a883d24e3ad609bb04faa3f52cbeaecfb24c1c3bcde8b496a5c Package ships a single 138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine zc with a...

Malicious code in pixsvg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f6989954f196f485ff049ef7dc22bb800a57187e6bdc8bd0e002ed4bbc1db7 The pixsvg module exports fetchDataFromSvgsvgData, which scans the input SVG for a comment of the form , reassembles the binary-encoded 1/0 sequence...

Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...

EUVD-2026-89476

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...