CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

EUVD-2026-60592

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

PT-2026-77141

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quic...

CVE-2026-73050

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050

CVE-2026-73050 affects SiYuan before v3.7.4, where the color field in attribute-view select options is not validated/escaped, allowing stored XSS via eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, enabling arbitrary Jav...

CVE-2026-73044

SiYuan before v3.7.4 is affected: it fails to validate/escape table column width values, enabling stored XSS via style attributes. Attackers can use the setAttrViewColWidth API to break out of style attributes and inject event handlers on every table cell, enabling arbitrary code execution in the...

CVE-2026-73044

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on eve...

PT-2026-73051

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...

CVE-2026-48813

A flaw was found in Flawfinder. An improper input neutralization issue leads to output manipulation, specifically, terminal/ANSI escape sequence injection and XML injection. A malicious filename can inject arbitrary content in the terminal output and improperly sanitized fields such as filenames,...

Cookie Attribute Injection

undici is vulnerable to cookie attribute injection. The vulnerability is due to insufficient sanitization of cookie domain and unparsed values in setCookie, allowing attacker-controlled input to inject or override cookie attributes such as SameSite, Secure, and HttpOnly, potentially weakening...

SUSE CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Impact The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons validateCookiePath already does at 0x3B, so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks ea...

undici: Undici: Cookie attribute injection allows bypassing security protections

A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...

undici: Undici: Cookie attribute injection allows bypassing security protections

A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...

EUVD-2026-42334

Mistune: XSS via unescaped class option in Admonition directive...

GHSA-G97X-GVCM-X72H Mistune: XSS via unescaped class option in Admonition directive

In src/mistune/directives/admonition.py, the renderadmonition function concatenates the :class: option directly into the HTML class attribute without escaping lines 63-68. This allows attribute injection and XSS even when HTMLRendererescape=True is used. The directive name parameter is safe...

CVE-2026-46640

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

OPENSUSE-SU-2026:21339-1 Security update for python-mistune

This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...

SUSE-SU-2026:22655-1 Security update for python-mistune

This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...

CVE-2026-55789 Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into...