CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

PT-2026-103824

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.3 through 6.49.9 Description Insufficient sanitization of data within the JSON-LD HTML tag emitted by the ghost head helper allows an authenticated user with limited privileges to inject unescaped content. This content is...

CVE-2026-102092

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting XSS that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session...

CVE-2026-102092 Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting XSS that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session...

CVE-2026-102092 Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting XSS that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session...

CVE-2026-102092

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-site Scripting (XSS) flaw. An authenticated attacker can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This vulnerability could lead to ...

EUVD-2026-90374

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting XSS that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session...

CVE-2026-102092: Improper Neutralization of Input During Web Page Generation

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting XSS that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session...

PT-2026-103530

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An authenticated user can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This Stored Cross-site Scriptin...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762361016)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762361016 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible fo...

EUVD-2026-83900

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-21806: Undefined Security Weakness

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

GHSA-XHQ9-WHGQ-49J5 Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

EUVD-2026-81670

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...