CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1. The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages such as campaigns, emails, and for...

CVE-2022-23861

CVE-2022-23861: Multiple Stored Cross-Site Scripting in YSoft SafeQ Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be leveraged to perform XSS...

CVE-2026-116647

Tanium addressed an improper output sanitization vulnerability in Comply...

CVE-2026-116649

Tanium addressed an improper output sanitization vulnerability in Enforce...

CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply.

Tanium addressed an improper output sanitization vulnerability in Comply...

EUVD-2026-111252

Tanium addressed an improper output sanitization vulnerability in Comply...

CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce.

Tanium addressed an improper output sanitization vulnerability in Enforce...

CVE-2026-116647

Tanium addressed an improper output sanitization vulnerability in the Comply product. The vulnerability is associated with CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The risk is characterized as HIGH severity (CVSS 3.1 score of 7.1) and requires user interaction . Speci...

CVE-2026-116649

Tanium addressed an improper output sanitization vulnerability in the Enforce product. The vulnerability is associated with CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The issue has a CVSS 3.1 score of 7.1 (HIGH) , with a network attack vector and low complexity, requiri...

EUVD-2026-111253

Tanium addressed an improper output sanitization vulnerability in Enforce...

PT-2026-127173

Tanium addressed an improper output sanitization vulnerability in Enforce...

PT-2026-127172

Tanium addressed an improper output sanitization vulnerability in Comply...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-78364

The MW WP Form WordPress plugin, in versions prior to 5.1.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain form settings before they are rendered on an admin dashboard page. This flaw allows users with permissions as low ...

EUVD-2026-67052

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-4259

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

CVE-2026-4336

The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling htmlentitydecode on postcontent during rendering in the setdisplayvariables function View.FAQ.class.php, line...