CVE-2026-12683

CVE-2026-12683 is a Stored XSS vulnerability in the management panel (Yönetim panel) of Ankaref Innovation and Technology Inc. LIBRID/LIBREF , caused by improper neutralization of input during web page generation. The issue affects versions 2.01.0.2183 through 10092026 . The CVSS 3.1 score is 5.4...

CVE-2026-12683 Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319...

WordPress Bread & Butter plugin < 8.7.0.139 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Bread & Butter versions 8.7.0.139...

WordPress Sidebar Manager Light plugin <= 1.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Sidebar Manager Light versions = 1.18...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

Multiple vulnerabilities in SHIRASAGI

Overview SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2026-81635 Authorization bypass CWE-639 - CVE-2026-82582 CVE-2026-81635 Tonosaki Aoba of Tokyo Denki University remote control Laboratory reported this vulnerability ...

CVE-2026-81635

SHIRASAGI by Security Science is affected by a cross-site scripting (XSS) vulnerability that may allow an attacker to execute arbitrary script in the web browser of a user who accesses a website using the product. The CNA (JPCERT) assigns a MEDIUM severity (CVSS 3.0 base score 5.4; CVSS 4.0 base ...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

EUVD-2026-75271

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

RLSA-2026:66016 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: golang-fip...

SUSE CVE-2026-87632

Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-75211

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

EUVD-2026-75220

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

EUVD-2026-75207

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

EUVD-2026-75210

yshopmall =3.3 is vulnerable to Cross Site Scripting XSS. The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files...

CVE-2026-87926

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

RLSA-2026:65895 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

image-builder security update

An update is available for image-builder. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A local binary for building customized OS artifacts such as VM images a...