Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting.

Summary ip-address is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-42338. Vulnerability Details CVEID:CVE-2026-42338 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1,...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting.

Summary postcss is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-41305. Vulnerability Details CVEID:CVE-2026-41305 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract...

CVE-2026-108264

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

EUVD-2026-95995

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” Critical Remote Code Execution in the World's Fastest In-Memory Store Redis Lua scripting just became the perfect post-auth landing zone. Authenticated attacker → crafted Lua script → escape sandbox → full RCE on host ⚠️ Overview CVE-2025-49844 "RediShell " is a...

WordPress WP Photo Album Plus plugin <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin WP Photo Album Plus versions = 9.3.03.002...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.15...

WordPress Real Estate Manager – Property Listing and Agent Management plugin <= 7.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Morato Antoine in WordPress Plugin Real Estate Manager versions = 7.3...

CVE-2025-68461

CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting XSS vulnerability via the animate tag in an SVG document. How does this detection method work? Extracts Roundcube version from the "rcversion" JSON field in the response, parses it into...

CVE-2016-20098

Moderator Toolbox reddit-moderator-toolbox before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields lik...

CVE-2026-42695

The FolioVision FV Flowplayer Video Player plugin for WordPress (versions

CVE-2026-104083

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

POC-CVE-2026-32621-Apollo-Federation-XSS-Vulnerability

CVE-2026-32621 - Apollo Federation Prototype Pollution PoC Overview Field| Value ---|--- CVE| CVE-2026-32621 CVSS| 9.9 Critical CWE| CWE-1321 Prototype Pollution Affected| Apollo Federation 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2 Patched| 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2 GHSA|...

EUVD-2026-95907

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...

test-xss-swagger-CVE-2019-1749

This repository does not have a README...

CVE-2026-108101

HortusFox hortusfox-web through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored...

EUVD-2026-95888

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-71497

Summary Vulnerability in jsoup.jar in IBM Integration Designer: CVE-2026-71497 Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a...

CVE-2026-108101 HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

HortusFox hortusfox-web through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored...