PT-2026-99136

Name of the Vulnerable Software and Affected Versions Horilla versions 1.0.0 through 1.5.9 Horilla version 2.0.0 affected versions not specified Description The get mail preview handlers in recruitment/views/actions.py and employee/not in out dashboard.py render a user-controlled body at the...

NPM: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

NPM: xhtml-purifier has HTML attribute-injection sanitizer bypass that leads to XSS vulnerability discovered by ? in WordPress Npm xhtml-purifier versions = 0.4.1...

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

GHSA-J8R4-32C5-33RC xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61784

The xhtml-purifier Node.js library (versions prior to 0.4.3 ) contains an HTML attribute-injection vulnerability in the attributeString() function of XHTMLPurifier.js. The root cause is a failure to HTML-entity-encode attribute values during serialization, allowing an attacker to use a double-quo...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-91122

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

DEBIAN-CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

UBUNTU-CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

EUVD-2026-86302

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122

The Discourse open-source discussion platform contains a vulnerability in the video placeholder component prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The root cause is an attribute breakout triggered by crafted HTML, allowing an attacker to inject a controlled event handler . An...

CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...

CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...