code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

CVE-2026-100190

The AIL Framework crawler splash domain page (showDomain.html ) is vulnerable to stored cross-site script injection (XSS) . The root cause is the direct interpolation of user-supplied data from imported crawler captures—specifically item IDs, URLs, and screenshot file paths —into inline JavaScrip...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

EUVD-2026-86590

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

OESA-2026-4035 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4036 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4034 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

PT-2026-98822

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...

CVE-2026-51772: Undefined Security Weakness

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-63432: Improper Control of Generation of Code

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

VulnCheck KEV: CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

PT-2026-99136

Name of the Vulnerable Software and Affected Versions Horilla versions 1.0.0 through 1.5.9 Horilla version 2.0.0 affected versions not specified Description The get mail preview handlers in recruitment/views/actions.py and employee/not in out dashboard.py render a user-controlled body at the...

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

GHSA-J8R4-32C5-33RC xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

NPM: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

NPM: xhtml-purifier has HTML attribute-injection sanitizer bypass that leads to XSS vulnerability discovered by ? in WordPress Npm xhtml-purifier versions = 0.4.1...