UBUNTU-CVE-2026-55214

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

EUVD-2026-87290

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

EUVD-2026-87285

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

CVE-2026-53610

The GLPI asset and IT management software package is vulnerable to reflected cross-site scripting (XSS) in versions 11.0.0 through 11.0.8 . An attacker can craft a specific URL for a dashboard that reflects attacker-controlled markup because the application fails to perform sufficient output enco...

CVE-2026-97896 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...

CVE-2026-97896

The krayin laravel-crm software (versions up to 2.2.5 ) is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the ConfigurationForm::rules function within the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the Upload Functionality component. This vulnerability al...

CVE-2026-97896 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...

EUVD-2026-87281

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...

CVE-2026-97896 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...

CVE-2026-56731 Zammad: Cross-Site Scripting in Ticket Notifications

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-56731 Zammad: Cross-Site Scripting in Ticket Notifications

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-56731 Zammad: Cross-Site Scripting in Ticket Notifications

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-100237

The Mediawiki - Thanks Extension is vulnerable to a Stored XSS flaw due to the improper neutralization of input during web page generation. This issue specifically impacts versions prior to 1.43.10 , 1.45.5 , and 1.46.1 . Exploitation details and specific impact data are not provided in the docum...

EUVD-2026-87242

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

CVE-2026-97868

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

DEBIAN-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...