CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-52741

GoCD (continuous delivery server), versions 18.3.0 through 26.1.0 , is affected by a stored cross-site scripting vulnerability in its tracking-tool link generation. When a project uses a lenient Tracking Tool regular expression with an ID capturing group (e.g., JIRA-(.+)), an attacker with commit...

EUVD-2026-83949

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

webkitgtk: Websites may know if the user has visited a given link

A flaw was found in WebKitGTK. Visiting a website allows malicious web content to know if a user has visited a given link due to improper checks...

ROS-20260921-73-0100

The vulnerability in “runc” is related to the tracking of symbolic links. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-52741: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

PT-2026-96131

Name of the Vulnerable Software and Affected Versions GoCD versions 18.3.0 through 26.0.0 Description Stored cross-site scripting occurs when the server generates unescaped tracking-tool links from commit comments. This happens when a project uses a lenient Tracking Tool regular expression with a...

CVE-2026-93984

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...

CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...

CVE-2026-93984

OpenPanel tracking API, through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 , fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. An attacker possessing only a public client ID can supply arbitrary dummy secrets to inject forged revenue me...

CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...

EUVD-2026-83589

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

PT-2026-95821

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994 Description The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing on...

CVE-2026-93984: Improper Authentication

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

EUVD-2026-83443

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-79713 Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...