CVE-2026-109355: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...

CVE-2026-108920: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...

CVE-2026-109558: Improper Neutralization of Input During Web Page Generation

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

PT-2026-110934

Name of the Vulnerable Software and Affected Versions EdgeEver versions 1.6.0 through 1.112.0 Description A stored cross-site scripting issue exists in TemplatesPane.tsx where template contentMarkdown is rendered with raw HTML using dangerouslySetInnerHTML without proper sanitization. This allows...

CVE-2026-109673: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-108919: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/addstudent.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtpreviousschool causes cros...

CVE-2026-85967: Improper Neutralization of Input During Web Page Generation

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosu...

CVE-2026-107866: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

PT-2026-110797

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the Web UI component due to improper handling of the title, note, URL, and content arguments within the eval function of the '/router/l7 call board user set.cgi'...

PT-2026-110772

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description A stored cross-site scripting issue exists in the get oxidized nodes list function. The application fails to escape Oxidized API fields and the SNMP sysName variable. An attacker who can control th...

CVE-2025-27895: Improper Neutralization of Input During Web Page Generation

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27896: Improper Neutralization of Input During Web Page Generation

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2026-104774: Encoding Error

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

PT-2026-110708

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.33 through 0.11.3 Description Authenticated users can execute scripts in other users' sessions by storing javascript: URLs within the citation embed url fields. An attacker can share a specially crafted chat; when a...

PT-2026-111003

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.58.0 Frappe versions prior to 15.4.0 Description A cross-site scripting issue exists in the printview feature because parameters are not escaped before being rendered. This allows remote attackers to craft a malicio...

PT-2026-110997

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2026-109633: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

FreeBSD : Gitlab -- vulnerabilities (5518664d-c652-11f1-b273-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5518664d-c652-11f1-b273-2cf05da270f3 advisory. Gitlab reports: Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4327)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

Debian dsa-6556 : nagios4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6556 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/securit...