CVE-2026-100380

CVE-2026-100380: Reflected XSS in language-validation errors Reporter: Marco Paciaroni BomboBombone. Wikibase included unescaped language-validation error text in the SetLabel page. Rejected input could be returned as executable HTML before the request reached the label-saving operation. Affected...

CVE-2026-76983

Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...

PT-2026-68147

Name of the Vulnerable Software and Affected Versions OpenBK7231T affected versions not specified Description The software fails to sanitize channel labels received via the MQTT SetChannelLabel command in the CHANNEL SetLabel function src/cmnds/cmd channels.c. These labels are stored using strdup...