CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-18534

ArcSearch for iOS versions prior to 1.48.0 has a spoofing vulnerability where the address bar remains hidden after a page-initiated scroll, letting attacker-controlled content mimic browser UI elements. CVSS 7.4 (HIGH) reflects the high integrity impact requiring user interaction. No exploitation...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

UBUNTU-CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-60693

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74978

CVE-2026-74978 is a clickjacking issue in the Firefox/Thunderbird Widget component. Affected versions include Firefox ESR 153.0 and Thunderbird 153/153.0; fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade ...

EUVD-2026-60691

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74951

CVE-2026-74951 is a clickjacking vulnerability in Firefox for Android , fixed in Firefox 154 . The flaw allows an attacker to trick a user into performing unintended actions by overlaying transparent or invisible UI elements. The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

EUVD-2026-60679

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

PT-2026-77011

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A clickjacking issue exists in the Widget component. Clickjacking is a technique where an...

PT-2026-76984

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description Clickjacking issue in Firefox for Android. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or li...

CVE-2026-44767

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

EUVD-2026-43597

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

HTML Injection

github.com/abhinavxd/libredesk is vulnerable to stored HTML injection. The vulnerability is due to improper sanitization of user input in the contact notes feature, which allows an attacker to inject arbitrary HTML by manipulating the request and exploit it to perform phishing, CSRF-style actions...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2026-23722

WeGIA (Web Manager for Charitable Institutions) before version 3.6.2 contains a Reflected Cross-Site Scripting (XSS) flaw in html/memorando/insere_despacho.php where the id_memorando GET parameter is echoed into HTML without proper sanitization/encoding. This allows unauthenticated attackers to i...

CVE-2025-68927

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/id/notes, the backend automatically wraps user input in tags. However, by intercepting the...

CVE-2025-68927 Improper Neutralization of HTML Tags in a Web Page in libredesk

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/id/notes, the backend automatically wraps user input in tags. However, by intercepting the...