CVE-2026-88208

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-70279

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-110239

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

CVE-2026-110228

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

CVE-2026-102864

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-102859

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-96230

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

EUVD-2026-100205

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

CVE-2026-96230

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

CVE-2026-96230

The ASP.NET Core framework is vulnerable to a cross-site scripting (XSS) issue caused by the improper neutralization of input during web page generation. An unauthorized attacker can exploit this vulnerability over a network to achieve execution of arbitrary code . The vulnerability has a CVSS sc...

EUVD-2026-100137

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-70279

Microsoft Exchange Server is affected by a cross-site scripting (XSS) vulnerability caused by the improper neutralization of input during web page generation. This flaw allows an unauthorized attacker to perform spoofing over a network. While the documents do not specify the exact internal compon...

CVE-2026-97783

A cross-site scripting (XSS) vulnerability exists in Microsoft Office SharePoint due to the improper neutralization of input during web page generation. An unauthorized attacker can leverage this flaw to perform spoofing over a network. Microsoft has released updates to address this issue, and us...

CVE-2026-88204

A cross-site scripting (XSS) vulnerability exists in Microsoft Office SharePoint due to the improper neutralization of input during web page generation. This flaw allows an authorized attacker to perform spoofing over a network. Microsoft has released updates to address this vulnerability; users ...

EUVD-2026-99047

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-102864

A cross-site scripting (XSS) vulnerability exists in Microsoft Office SharePoint due to the improper neutralization of input during web page generation. This flaw allows an authorized attacker to perform spoofing over a network. Microsoft has released updates to address this issue; users are enco...

EUVD-2026-99042

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-102859

A cross-site scripting (XSS) vulnerability exists in Microsoft Office SharePoint due to the improper neutralization of input during web page generation. This flaw allows an authorized attacker to perform spoofing over a network. Microsoft has released security updates to address this issue; users...

CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104816

The open source federated social media platform Misskey is vulnerable to Cross-site Scripting (XSS) in its RSS components. Specifically, versions 12.0.0 through 2026.7.0 fail to verify URL schemes for feed item links. An attacker who controls feed content can provide an unsafe-scheme link , leadi...