CVE-2026-90957

MISP versions ≤2.5.45 are affected by a stored XSS vulnerability in the serve path for uploaded SVG images , which are delivered inline without a restrictive browser sandbox. Because SVGs are XML documents rather than passive bitmaps, embedded [removed] elements, event handlers, or javascript: UR...

PT-2026-37178

Name of the Vulnerable Software and Affected Versions Roadiz versions prior to 2.3.43 Roadiz versions prior to 2.5.45 Roadiz versions prior to 2.6.31 Roadiz versions prior to 2.7.18 Description The roadiz/openid package fails to properly implement the OIDC nonce validation process. While the...