EUVD-2026-87765

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...

GHSA-QXG3-46RW-79J8 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

CVE-2026-100190

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

CVE-2026-100176

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100190

The AIL Framework crawler splash domain page (showDomain.html ) is vulnerable to stored cross-site script injection (XSS) . The root cause is the direct interpolation of user-supplied data from imported crawler captures—specifically item IDs, URLs, and screenshot file paths —into inline JavaScrip...

CVE-2026-100190 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

EUVD-2026-87096

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

CVE-2026-100190 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

EUVD-2026-87089

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176

The AIL Framework username timeline feature is vulnerable to stored cross-site scripting (XSS) . The application stores usernames from chats and crawled forums without character restrictions. When an authenticated analyst views the timeline, the client-side JavaScript file var/www/static/js/d3/ti...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

EUVD-2026-87087

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

PT-2026-98391

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description Session fixation in the HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session. This occurs because the system reuses ...

CVE-2026-100176: Improper Neutralization of Input During Web Page Generation

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100190: Improper Neutralization of Input During Web Page Generation

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

PT-2026-98847

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The username timeline feature is susceptible to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup inside srcdoc is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe...