CVE-2026-118256

A flaw was found in vue-i18n. When parameter escaping is enabled, the library fails to properly sanitize named interpolation values if a translation call contains both list and named parameters. A remote attacker could exploit this vulnerability by supplying untrusted input to an application that...

CVE-2026-59774_docker

CVE-2026-59774docker 1. Pull gitea git clone https://github.com/FlowerWitch/CVE-2026-59774docker cd ./CVE-2026-59774docker docker compose up -d 2. Initialization Access gitea http://localhost:3000/install 3. Create repository new repository defaults to public, no other configuration needed 4...

bruno

Bruno - Opensource IDE for exploring and testing APIs. English | Українська | Русский | Türkçe | Deutsch | Français | Português BR | 한국어 | বাংলা | Español | Italiano | Română | Polski | 简体中文 | 正體中文 | العربية | 日本語 | ქართული | Nederlands | فارسی | हिन्दी Bruno is a new and innovative API client,...

CVE-2026-100381

CVE-2026-100381: DOM XSS in Flickr collection and set titles Reporter: Marco Paciaroni BomboBombone. UploadWizard inserted Flickr collection and set titles through an API that interpreted strings as HTML. External title metadata could therefore become executable markup in the wiki page. Affected...

Highcharts Grid parses pagination language options as HTML

Impact The pagination language strings are written into the DOM as markup rather than as text. An attacker who controls those language options can supply elements carrying event handlers, and those handlers execute in the origin of the page hosting the Grid when the pagination controls render...

EUVD-2026-112356

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-118254

The Highcharts JS charting library (versions 2.0.0 through 3.2.0 ) contains a vulnerability where pagination language strings are incorrectly written into the DOM as HTML markup instead of plain text. An attacker who can control the Grid language configuration can inject elements with event handl...

CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

EUVD-2026-89994

Satori-generated SVG has improper escaping...

GHSA-WX4J-MVGX-MQWP Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

MGASA-2026-0554 Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

EUVD-2026-109461

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allowrawhtml gate, executing JavaScrip...

CVE-2018-7600

Proof-Of-Concept for CVE-2018-7600 / SA-CORE-2018-002 codebeat badge Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. H...

CVE-2026-115897

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions,...

CLSA-2026-1790252195 expat: Fix of 3 CVEs

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2/BIG2ISINVALIDCHAR and the matching little2/big2isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a...

Linux Distros Unpatched Vulnerability : CVE-2026-109266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived da...