CVE-2026-54477

CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

[SECURITY] [DLA 4832-1] nagios4 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4832-1 [email protected] https://www.debian.org/lts/security/ Russell Stuart October 13, 2026 https://wiki.debian.org/LTS -...

WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureCart versions = 4.9.4...

CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-67165

The software HCL Connections is vulnerable to a cross-site scripting (XSS) attack (CWE-79). An attacker may leverage this vulnerability to execute arbitrary script code within the browser of an unsuspecting user. The potential impact includes the theft of cookie-based authentication credentials ,...

CVE-2026-54869

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1...

CVE-2026-54870 WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...

CVE-2026-54870

The Weaver Xtreme Theme Support plugin (weaverx-theme-support) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions n/a through 7.0.1 . The root cause is the improper neutralization of input during web page generation . This vulnerability allows an attacker to execute mali...

WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Weaver Xtreme Theme Support versions = 7.1...

jquery-cve-2022-31160

jQuery UI CVE-2022-31160 Vulnerability Demonstration This project demonstrates the jQuery UI Checkboxradio Widget Refresh Vulnerability CVE-2022-31160 , which allows HTML entity decoding during widget refresh operations, potentially leading to Cross-Site Scripting XSS attacks. 🚨 Security Warning ...

CVE-2026-108942

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-92883

GitLab CE/EE is vulnerable to a Cross-site Scripting (XSS) issue due to the improper sanitization of HTML attributes in syntax-highlighted output. This flaw could allow an authenticated user to execute arbitrary JavaScript within the browser sessions of other users by interacting with a specially...

EUVD-2026-98062

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

EUVD-2026-98165

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

EUVD-2023-60714

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

EUVD-2025-211072

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

CVE-2026-108942 philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-108942 philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-108942

A security flaw exists in philz1337x clarity-upscaler (up to commit cfbdb842c6c839c8e97741722b8cf9a4b7662d98) within the Extra Networks Card Rendering component. The root cause is improper neutralization of input in the create_html_for_item function of the modules/ui_extra_networks.py file, where...

CVE-2026-103418: Improper Neutralization of Input During Web Page Generation

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...