EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

EUVD-2026-63694

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

EUVD-2026-63686

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

EUVD-2026-63682

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...

CVE-2026-75526

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-50190

Shaarli versions prior to 0.16.3 are vulnerable to stored XSS in the permalink handler of BookmarkListController.php, where raw bookmark titles are emitted unescaped into the document . An attacker who controls a remote page's title can have it fetched verbatim when an admin bookmarks the URL, pl...

CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

EUVD-2026-63551

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

Winter: Stored XSS through Backend List widget image columns

Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...

django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Summary The Blade template for the color column type src/resources/views/crud/columns/color.blade.php has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column'escaped' defaults to true, values stored in color columns are rendere...

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

EUVD-2026-63571

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

EUVD-2026-63496

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-73220

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to...