PT-2026-84435

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script...

PT-2026-84507

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...

PT-2026-84407

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A stored cross-site scripting XSS issue exists in the web-based management interface. This allows an unauthenticated adjacent attacker to execute arbitrary script code ...

PT-2026-84498

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's...

EUVD-2026-68793

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS through org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions in the palette option-rendering...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses cryptography-46.0.7-cp311-abi3-manylinux234x8664.whl, pyjwt-2.12.1-py3-none-any.whl, jackson-databind-2.21.2.jar, jackson-core-2.21.2.jar, protobufjs-8.0.1.tgz, websocket-driver-0.7.4.tgz, pyasn1-0.6.3-py3-none-any.whl, js-yaml-3.14.2.tgz which is...

NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...

NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

PT-2026-83678

Use of Insufficiently Random Values vulnerability in ash-project ash admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp nonce assign key, AshAdmin.Router.ash admin/2 defaulted the img, style, and script nonces to...

PT-2026-84025

Name of the Vulnerable Software and Affected Versions SliceWP versions 1.2.10 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-84004

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...