CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

EUVD-2026-55082

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-45572

CVE-2026-45572 affects Decidim: HTML content blocks allow stored script execution. An administrator with landing-page editing rights can store arbitrary HTML/JavaScript in an HTML content block, which is rendered without sanitization by Decidim::ContentBlocks::HtmlCell#html_content, leading to sc...

CVE-2026-45572 Decidim: HTML content blocks allow stored script execution

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...

CVE-2026-45572 Decidim: HTML content blocks allow stored script execution

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...

CVE-2026-11588

The CVE-2026-11588 entry concerns the EONSR AEO Agent WordPress plugin up to version 3.7.9. The issue arises because there is no authorization check on a REST API route and HTML sanitisation is disabled before saving a post, enabling unauthenticated attackers to create administrator-attributed pu...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

SUSE CVE-2026-65901

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-70492

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70486

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

MAL-2026-11521 Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

CVE-2026-16881

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

CVE-2026-13340

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

Cybozu Garoon vulnerable to cross-site scripting

Overview Scheduler in Cybozu Garoon provided by Cybozu, Inc contains the following vulnerability: Cross-Site Scripting CWE-79 - CVE-2026-57279 CyCDB-4148 Cybozu, Inc reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc coordinated under t...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

SUSE CVE-2026-52807

Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...

CVE-2026-59328

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...