CVE-2026-72553

CVE-2026-72553 describes a stored cross-site scripting flaw in ElkArte Forum 2.0 Beta 1. The issue allows any registered member to inject persistent JavaScript into profile fields cust_blurb and cust_locate, which are saved without HTML encoding and rendered unescaped in admin-visible profile vie...

WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by K. Sorrachat in WordPress Plugin Welcart e-Commerce versions = 2.11.31...

WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

CVE-2026-73161

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted tags without first...

CVE-2026-73159

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73158

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to...

EUVD-2026-55993

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted tags without first...

CVE-2026-73161 cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted tags without first...

CVE-2026-73161

CVE-2026-73161 affects certain versions of cti-transmute where the highlight() function mishandled conversion-table values passed to the search highlighting feature. The original implementation could return raw text when no query was supplied or perform a regex replace that inserted tags without...

CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

CVE-2026-73159

CVE-2026-73159 affects certain versions of cti-transmute where a tag’s icon can be stored and later interpolated into HTML via Vue v-html. The root cause is user-supplied icon values that were used to build HTML strings like , enabling potential HTML injection when rendered in the viewer’s browse...

EUVD-2026-55979

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

Security update for xmlrpc-c

This update for xmlrpc-c fixes the following issue: CVE-2026-15928: reflected cross-site scripting XSS via HTML injection in the error page component bsc1272769. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2026-73158

CVE-2026-73158 affects cti-transmute; saved graph configurations can include style properties and an svgIcon value that Pivotick may render as HTML, enabling script execution in other viewers’ browsers. Root cause: insufficient validation of saved graph configuration data. The fix adds a strict s...

EUVD-2026-55976

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to...

CVE-2026-73158 cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to...

CVE-2026-73156

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...