CVE-2026-100380

CVE-2026-100380: XSS riflesso negli errori di convalida della lingua Segnalatore: Marco Paciaroni BomboBombone. Wikibase includeva il testo dell'errore di convalida della lingua non sottoposto a escape nella pagina SetLabel. L'input rifiutato poteva essere restituito come HTML eseguibile prima ch...

CVE-2026-76983

Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...

PT-2026-68147

Name of the Vulnerable Software and Affected Versions OpenBK7231T affected versions not specified Description The software fails to sanitize channel labels received via the MQTT SetChannelLabel command in the CHANNEL SetLabel function src/cmnds/cmd channels.c. These labels are stored using strdup...