code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...

EUVD-2026-86384

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass...

GHSA-VJ3Q-VP3G-J9C8 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...

CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

EUVD-2026-87064

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

CVE-2026-100172

The AIL Framework (ail-project/ail-framework) is vulnerable to a stored cross-site scripting (XSS) flaw in two Jinja2 templates: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. The root cause is the interpolation of dynamic values (such as ic...

BIT-GITLAB-2026-7514 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

BIT-GITLAB-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

EUVD-2026-86577

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...

CVE-2026-83591

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-83591 AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86535

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-83591

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.16 . The root cause is insufficient input sanitization and output escaping during a Regex Transformation of comment content. Specifically, the ...

CVE-2026-83591 AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-98364

Name of the Vulnerable Software and Affected Versions AMP for WP versions prior to 1.1.17 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. The issue occurs during Regex Transformation,...

PT-2026-98837

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A stored cross-site scripting XSS issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: var/www/templates/chats explorer/block message.ht...

CVE-2026-100172: Improper Neutralization of Input During Web Page Generation

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

PT-2026-98981

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

EUVD-2026-87081

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...