CVE-2026-18247

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48494

Vulnerability summary: TypeBot (versions around 3.16.1) contains an authentication/authorization flaw in its WhatsApp preview workflow. An authenticated user with read access to any typebot can resume a WhatsApp preview webhook session belonging to a different typebot by combining an authorized t...

EUVD-2026-56780

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

EUVD-2026-56220

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-18247

The CVE-2026-18247 describes a DOM-based XSS in BlackBerry AtHoc Web Portals (AtHoc IWS). Affected versions are earlier than 7.21 HF-734; exploitation could allow an attacker to perform actions in the victim’s session. Remediation is to upgrade to 7.21 HF-734 or later. The available connected doc...

EUVD-2026-56218

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72747

CVE-2026-72747 describes a stored cross-site scripting (XSS) in AVideo. An unauthenticated user can register and submit a phone value that is not sanitized, allowing JavaScript to be stored in the database. When an administrator visits the users management page, the unsanitized phone value is ren...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

EUVD-2026-56029

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-72553 ElkArte Forum ElkArte - Cross-Site Scripting

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553

CVE-2026-72553 describes a stored cross-site scripting flaw in ElkArte Forum 2.0 Beta 1. The issue allows any registered member to inject persistent JavaScript into profile fields cust_blurb and cust_locate, which are saved without HTML encoding and rendered unescaped in admin-visible profile vie...

CVE-2026-72553 ElkArte Forum ElkArte - Cross-Site Scripting

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...