53 matches found
CVE-2026-107306
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...
CVE-2026-107306
The Drupal Menu Link Attributes module (versions 0.0.0 to 1.8.0 ) is vulnerable to Stored Cross-site Scripting (XSS) due to insufficient sanitization of HTML attributes applied to menu link container elements (such as ). Practical exploitation requires a high level of privilege: an attacker must ...
EUVD-2026-113566
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...
CVE-2026-107306 Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...
CVE-2026-107306 Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...
CVE-2026-107306: Drupal Menu Link Attributes: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link…
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...
PT-2026-107760
This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...
Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...
Oracle Linux 9 : ELSA-2026-66203-0: / python3.12-lxml (ELSA-2026-662030)
The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-662030 advisory. 4.9.3-2.1 - Fix CVE-2026-49825: add xlink:href to known HTML link attributes Resolves: RHEL-251488 Tenable has extracted the preceding description block...
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...
CVE-2026-13712
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...
CVE-2026-13712 Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...
CVE-2026-13712
The Divi WordPress theme versions 5.0 to 5.8.1 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of Social Media Follow module settings in link attributes. An attacker with Contributor level privileges can use the REST API to create a pending post containing a malicious ...
PT-2026-73117
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...
CVE-2026-13712: Improper Neutralization of Input During Web Page Generation
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...
CVE-2026-45064
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...
CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...
CVE-2026-48591 Stored XSS via unescaped HTML attribute values in earmark
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':makeatt1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: ...
PT-2026-50510
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform': make att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes...