PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

SUSE CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

OpenAM Insecure SSO Cookie Initialization

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION:...

CLSA-2026-1786731971 TuxCare security update for dompurify (6 CVEs)

TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.1.6-tuxcare.7...

CLSA-2026-1786731948 TuxCare security update for dompurify (33 CVEs)

TuxCare rebuilt dompurify to address 33 CVEs. Fixed in 3.0.3-tuxcare.1...

CLSA-2026-1786731853 TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.3...

Exploit for CVE-2026-12345

CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58731

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-73492

A flaw was found in Loofah, a library used for processing HTML and XML documents. The 'alloweduri?' function, intended to validate Uniform Resource Identifiers URIs, does not correctly identify and reject 'javascript:' or 'vbscript:' URIs when their scheme is obscured by specific HTML-encoded...

CVE-2026-73491

A flaw was found in Loofah. The Loofah::HTML5::Scrub.alloweduri? function fails to properly detect javascript: Uniform Resource Identifiers URIs when their scheme is split or prefixed with HTML5 named whitespace character references, such as or . This vulnerability allows a remote attacker to cra...

CVE-2026-73490

A flaw was found in Loofah. The HTML5 sanitizer incorrectly applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A remote attacker could exploit this by crafting a sanitized SVG that referenc...

CVE-2026-73648

A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

CVE-2026-73415

A flaw was found in JupyterLab. The ImageViewer component improperly handles specially crafted SVG images by revoking a blob URL too early. This allows a remote attacker to exploit a cross-site scripting XSS vulnerability when a malicious image is opened through the image viewer and subsequently ...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...