CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 are affected by a stored XSS in the content manager WYSIWYG preview component (PreviewWysiwyg.tsx). The component fails to strip [removed] tags from rich text, allowing an Author -role user to inject malicious scripts that execute when an E...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86771

Snipe-IT versions before 8.7.0 are vulnerable to Server-Side Request Forgery (SSRF) through the employee_num field in the asset acceptance PDF generator. The root cause is a failure to HTML-escape this field before passing it to TCPDF's writeHTML() function, allowing an attacker with the users.ed...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-85418

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

EUVD-2026-74720

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

cve-2023-30253

CVE-2023-30253 Description Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: ?PHP instead of ?php in injected data. Documentation CVE-2023-30253 GitHub Advisory: GHSA-9wqr-5jp4-mjmh Setup root@kitploit: git clone...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

CVE-2026-59319 RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

CVE-2026-59319

Spring AI 2.0.0 is affected by a RediSearch tag injection in RedisChatMemoryRepository.findByMetadata(). The method builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike sibling methods (get(), clear(), findByTimeRange()) that...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

EUVD-2026-65202

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704

Adminer versions before 5.4.3 are vulnerable to cross-site scripting (XSS) caused by unsanitized database server version strings being inserted into [removed] tags that carry valid CSP nonces. An attacker who controls a rogue MySQL server can return a crafted version string that breaks out of the...

Astra Linux – Vulnerability in python-reportlab

All versions of the reportlab package are vulnerable to Server-side Request Forgery SSRF via img tags. To reduce this risk, use trustedSchemes and trustedHosts see Reportlab’s documentation. Steps to reproduce by Karan Bamal: 1. Download and install the latest version of the reportlab package. 2...

EUVD-2026-64262

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing...

CVE-2026-14325

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...