EUVD-2026-119548

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...

CVE-2026-124493

SunEditor versions prior to 3.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw within the DocumentType constructor . The root cause is the injection of header textContent into innerHTML without proper HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers, which exe...

Public-Vulnerability-Disclosures

Public Vulnerability Disclosures Public disclosures of vulnera...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

PT-2026-96236

Name of the Vulnerable Software and Affected Versions Stencil core version 4.43.5 Description A DOM-based cross-site scripting XSS issue exists in the component runtime. When a downstream application enables the experimental slot fixes option and utilizes scoped components, assigning a string to...

CVE-2026-79320: Improper Neutralization of Input During Web Page Generation

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

EUVD-2026-84152

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime . The issue occurs when a downstream application enables the experimental slot fixes option and utilizes scoped components . Specifically, assigning a string to the textContent property of a...

CVE-2026-75531

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Vulnerability overview: CVE-2026-73157 affects the cti-transmute remote MISP event browser. The exploit stems from HTML interpolation of remote MISP fields (event IDs, info, organization names, tags, TLP, etc.), enabling injection of HTML/script content into the event-browser UI when a malicious/...

EUVD-2026-55975

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

EUVD-2026-49851

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...