1243979 matches found
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
PT-2026-103117
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...
PT-2026-103263
Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...
PT-2026-103198
Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...
PT-2026-103255
Name of the Vulnerable Software and Affected Versions OAuth Single Sign On – SSO OAuth Client versions prior to 7.1.3 Description An authentication bypass exists in the OAuth Single Sign On – SSO OAuth Client plugin that is reachable pre-login. This allows unauthenticated attackers to forge a...
CVE-2026-97262: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
PT-2026-103213
Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...
PT-2026-103250
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12.1 versions...
PT-2026-103328
Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...
PT-2026-103249
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-55214
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website field...
PT-2026-103265
Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...
PT-2026-102995
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...
PT-2026-103149
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
CVE-2026-94078: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...
PT-2026-103165
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...
PT-2026-103261
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-103389: Improper Neutralization of Input During Web Page Generation
MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...