1138215 matches found
SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory. This update for nodejs22 fixes the following issues Update to 22.23.0: - CVE-2026-6733: undici: Undici: Response queue poisoning on...
CVE-2026-50767
A stored cross-site scripting XSS vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field checkinmsg...
CVE-2026-50766
A stored cross-site scripting XSS vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edititems permission to inject arbitrary web scripts via the item public notes field items.itemnotes...
GHSA-75MW-H36V-2JV7 Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Summary The HTML and RSS output handlers in dosagelib/events.py write user-controlled content comic text and page URLs directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can...
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Summary The HTML and RSS output handlers in dosagelib/events.py write user-controlled content comic text and page URLs directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can...
EUVD-2026-37511
Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing...
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...
CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...
CVE-2026-52781
OpenProject CVE-2026-52781 affects the open-source, web-based project management software. Prior to versions 17.3.3 and 17.4.1, the HTML sanitizer allowed elements to have unrestricted data-* attributes via a :data wildcard. An attacker could inject data-controller="poll-for-changes" into a work...
Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks
Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via cross-site scripting XSS is vulnerable to an escalation attack...
EUVD-2025-210360
Contributor Cross Site Scripting XSS in Image Carousel = 1.0.0.41 versions...
EUVD-2025-210361
Contributor Cross Site Scripting XSS in BNE Testimonials = 2.0.8 versions...
CVE-2026-57656
Author Cross Site Scripting XSS in Hester Core = 1.1.8 versions...
CVE-2026-57651
Contributor Cross Site Scripting XSS in Ghost Kit = 3.6.0 versions...
CVE-2026-57650
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.3 versions...
CVE-2026-57638
Contributor Cross Site Scripting XSS in Fluent Booking = 2.1.0 versions...
CVE-2026-57629
Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...
CVE-2026-57325
Unauthenticated Cross Site Scripting XSS in NanoMag = 1.8 versions...