CVE-2026-76975: Improper Neutralization of Input During Web Page Generation

Due to a DOM-Based Cross-Site Scripting XSS vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper...

CVE-2026-102982: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

CVE-2026-63171: Improper Neutralization of Input During Web Page Generation

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute...

PT-2026-111130

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A DOM-Based Cross-Site Scripting XSS issue exists where an unauthenticated attacker can create a malicious link. When an authenticated user visits this link,...

CVE-2026-110078: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110077: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110074: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-104252: Improper Neutralization of Input During Web Page Generation

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...

CVE-2026-76976: Improper Neutralization of Input During Web Page Generation

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

CVE-2026-109662

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2026-109670

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the rendering of record names without proper escaping . An attacker with write access to item master data can inject a malicious script into a rec...

CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2026-85967

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to a cross-site scripting (XSS) vulnerability. A remote attacker could execute scripts within the browser session of an authenticated user, potentially leading to the disclosure of information or the perfo...

MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...

EUVD-2026-97127

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

PT-2026-110998

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description Authenticated attackers can execute scripts in the browsers of users who view rendered content. This occurs because the html2text function weakly sanitizes...

CVE-2026-48212: Improper Neutralization of Input During Web Page Generation

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...