GHSA-GQGW-JGHV-MXWX tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

EUVD-2026-57063

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318

The CVE concerns tablib prior to version 3.10.0, where the HTML export path (export_book in _html.py) interpolates dataset titles unsafely, enabling stored XSS. Attackers can rename worksheet sheets in imported files (XLSX, ODS, XLS, YAML) to inject script payloads into the Dataset title attribut...

Linux Distros Unpatched Vulnerability : CVE-2026-73295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in...

Linux Distros Unpatched Vulnerability : CVE-2026-9318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScri...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

PT-2026-71118

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description An authenticated attacker can bypass frontend controls to inject persistent script content. This allows for a stored cross-site scripting attack, where malicious scripts are permanently store...

PT-2026-71318

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

PT-2026-71310

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

PT-2026-71082

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the render tag badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the...

PT-2026-71057

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

PT-2026-71081

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource tags, assembled by unroll dict and parse html string, into generated reports without HTML escaping, allowing a cloud principal who can modify a...

PT-2026-71154

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-71229

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...