CVE-2026-69233: Improper Neutralization of Input During Web Page Generation

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, an...

EUVD-2026-62932

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-76367

In Splunk SOAR versions below 8.6.0, the Notes feature fails to sanitize content when a note's format changes, allowing an "Incident Commander" role user to store JavaScript that executes in another user's browser upon viewing. This stored XSS requires phishing the target to initiate a browser re...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitizeHtml function. An attacker can execute...

PT-2026-71456

Serendipity versions = 2.3.5 and . In include/functions routing.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives strip tags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search li...

CVE-2026-15249: Improper Neutralization of Input During Web Page Generation

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

EUVD-2026-56850

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-21269 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-21269

CVE-2026-21269 (Adobe ColdFusion) describes a stored cross-site scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a victim’s browser when visiting the page containing th...

PT-2026-70320

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A stored Cross-Site Scripting XSS issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. This results in the execution ...

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

SummaryAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

CVE-2026-57279

The CVE-2026-57279 entry concerns Cybozu Garoon with a Cross-Site Scripting (CWE-79) vulnerability in the Scheduler component. An attacker could inject and execute arbitrary script in the web browser of a user who is logged into Garoon, potentially leading to session takeover or hijacking of user...

CVE-2026-15032: Improper Neutralization of Input During Web Page Generation

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-65986: Improper Neutralization of Input During Web Page Generation

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type...

CVE-2026-66824

CVE-2026-66824 is a stored XSS vulnerability in the capture tree visualization page. The app embeds the serialized capture tree directly into an inline JavaScript block via the Jinja safe filter. Attackers can craft values from captured content that terminate the [removed] tag and inject arbitrar...

PT-2026-64010

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery

Cross-Site Scripting XSS remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding agents offer a promising approach to XSS discovery by combining source-code reasoning with interactive testing against a running application. However, a coding agent's claims...

EUVD-2026-44870

The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browse...

CVE-2026-11371

The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browse...

PT-2026-60412

The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browse...