CVE-2026-14290

CVE-2026-14290 concerns the WordPress plugin “Embed Google Photos album” (versions

CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-18109

The CVE-2026-18109 entry concerns the W3 Total Cache WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when u...

CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

EUVD-2026-58570

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

EUVD-2026-58512

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

Linux Distros Unpatched Vulnerability : CVE-2026-56858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in R...

Linux Distros Unpatched Vulnerability : CVE-2026-73417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6....

Linux Distros Unpatched Vulnerability : CVE-2026-73648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...

pgadmin4-9.17-1.1 on GA media (moderate)

pgadmin4-9.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11508-1 Rating: moderate Cross-References: CVE-2026-12044 CVE-2026-12045 CVE-2026-12046 CVE-2026-12047 CVE-2026-12048 CVE-2026-12049 CVE-2026-12050 CVE-2026-1707 CVE-2026-17347 CVE-2026-17349 CVE-2026-17350 CVE-2026-17351...

CVE-2026-73428

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...

CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

DEBIAN-CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-73417

Summary: CVE-2026-73417 affects JupyterLab 3.3.0 through 4.5.10 and 4.6.2 where the Settings Editor’s overrides.json support allows unvalidated content to be inserted into style, enabling code execution instead of display changes via crafted settings. The vulnerability arises from insufficient va...

CVE-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-73428 Trix: Stored XSS via HTMLParser attribute injection on paste

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...

CVE-2026-73428

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...