EUVD-2026-57942

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539

CVE-2026-27539 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Welcart e-Commerce plugin, versions

CVE-2026-27537 WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.11.2 versions...

EUVD-2026-57934

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2026-19716

CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

EUVD-2026-57930

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

Vulnerabilities managed in GitLab Enterprise Edition and Community Edition

GitLab has identified several vulnerabilities in its GitLab Enterprise Edition and Community Edition versions, ranging from 12.0 to 19.2.2. These vulnerabilities concern various aspects of GitLab, including incorrect privilege allocation, where users with pending membership statuses inadvertently...

CVE-2026-65900

A flaw was found in DOMPurify. When configured to sanitize HTML templates for direct Document Object Model DOM output, the software fails to properly remove malicious template expressions. This allows an attacker to inject specially crafted input that bypasses the sanitization process...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CLEANSTART-2026-YC09522 Security fixes in thingsboard 4.3.1.3-r5

Package thingsboard version 4.3.1.3-r5 fixes 4 vulnerabilities: CVE-2026-59869, ghsa-52cp-r559-cp3m, ghsa-h67p-54hq-rp68, CVE-2026-53550...

CVE-2026-73628

The CVE-2026-73628 entry concerns Serendipity versions 2.3.5 through 2.6.0, which contain a reflected XSS in the search clean-URL route (/search/). In include/functions_routing.inc.php, the serveSearch() sanitisation sequence applies urldecode() after HTML-encoding, allowing a URL-encoded HTML pa...

EUVD-2026-57797

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628 Serendipity 2.3.5 Reflected XSS via search clean-URL route

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

CVE-2026-3639

CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...