PT-2026-82485

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-79939

Dell PowerProtect Cyber Recovery versions prior to 20.3 contain a UNIX Symbolic Link (Symlink) Following vulnerability. A low-privileged attacker with local access could exploit this to achieve script injection . NVD scores it 7.8 (High) while Dell's CNA assessment rates it 5.8 (Medium) , reflect...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

EUVD-2026-66706

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed vulnerability discovered by ? in WordPress Npm suneditor versions = 3.1.3...

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

CVE-2026-54606

SunEditor (lightweight WYSIWYG JavaScript editor) is vulnerable to DOM-based cross-site scripting in its Embed plugin (src/plugins/modal/embed.js). Prior to version 3.1.4 , the plugin parses attacker-controlled raw embed HTML using DOMParser; when an external [removed] element follows a valid , i...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

EUVD-2026-66595

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

MAL-2026-15604 Malicious code in @worrisome/reutil (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15611 Malicious code in mn4xcouzvhus (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...