CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

CVE-2026-71497 affects the jsoup Java HTML parser. From 1.14.3 up to 1.23.1, the parser could mis-handle a malformed tag name ending in a control character, causing the tag to adopt the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this mispars...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445

The CVE-2026-71445 entry concerns AIL Framework. It describes an authenticated reflected cross-site scripting flaw in the /tag/add_tags endpoint, where an error message is emitted directly as HTML via str(res[0]), allowing attacker-controlled input to be reflected without proper encoding. Exploit...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-68747

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-18258

CVE-2026-18258 affects Scripta/eScriptorium up to version 26.04.1, impacting the Line, LineTranscription, VirtualCollection, tag and process API endpoints. The root cause is authorization bypass where a remote authenticated user can read, modify, and delete other users’ transcription content. Thi...

MAL-2026-13421 Malicious code in @trackunit/iris-app-sdk-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c This version of @trackunit/iris-app-sdk-vite declares cross-keychain: ^1.1.0 in its package.json dependencies. cross-keychain is a package associated...

SUSE-SU-2026:23167-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

CVE-2026-71497: Improper Neutralization of Input During Web Page Generation

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

PT-2026-68808

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A reflected cross-site scripting issue exists in the '/tag/add tags' endpoint. When a tag operation fails, the application returns the error value as an HTML response via the strres0...

PT-2026-68609

Name of the Vulnerable Software and Affected Versions Scripta/eScriptorium versions prior to 26.04.2 Description An authorization bypass exists in the 'Line', 'LineTranscription', 'VirtualCollection', 'tag', and 'process' API endpoints. This issue allows a remote authenticated user to read, modif...

PT-2026-68508

🚨 CVE-2026-28141 - high 🚨 NextGEN Gallery = 4.2.3 - Reflected Cross-Site Scripting NextGEN Gallery through 4.2.3 reflects a URL-decoded ngg tag route value into the g... 👾 https://t.co/No4GJJJ3Dv @pdnuclei NucleiTemplates cve...

CVE-2026-71445: Improper Neutralization of Input During Web Page Generation

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...