PT-2026-99362

Name of the Vulnerable Software and Affected Versions Hugo versions 0.75.0 through 0.165.x Description A stored cross-site scripting issue exists because the syntax highlighter fails to escape the lineAnchors option before passing it to Chroma. This causes the value to be written verbatim into th...

CVE-2026-100383

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100381

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100380

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100376

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100383

The Mediawiki - WikiLambda Extension version 1.47.0-alpha is vulnerable to Cross-Site Scripting (XSS) due to Improper Neutralization of Input During Web Page Generation . An attacker with high privileges and passive user interaction could potentially execute scripts in the context of the victim's...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100381

The Wikimedia Foundation Mediawiki - UploadWizard Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the Flickr collection and set titles allow for DOM XSS . This issue affects versions prior to 1.46.1 , 1.45.5 ,...

CVE-2026-100380

The Wikimedia Foundation Mediawiki - Wikibase Extension is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the issue exists within the Special:SetLabel language validation component. This vulnerability aff...

EUVD-2026-87345

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100376

The Wikimedia Foundation Mediawiki - TemplateSandbox Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability can be exploited by tricking another user into previewing a page that utilizes a specific sandbox prefi...

EUVD-2026-87359

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-96877

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96878

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96878 Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

EUVD-2026-87318

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

EUVD-2026-87313

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96875

The Mediawiki - Cargo extension is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability affects versions through 3.9.4 . While one record identifies the flaw in the context of Cargo Drilldown hierarchy filter...

CVE-2026-97897

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97896

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...