UBUNTU-CVE-2026-4292

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

CVE-2026-3466

Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking a...

EUVD-2026-19598

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-3466

CVE-2026-3466 affects Checkmk dashboards where dashlet title links are not properly sanitized, enabling stored XSS when a user with dashboard creation privileges creates a shared dashboard. Affected versions include Checkmk 2.2.0 (EOL), 2.3.0 before 2.3.0p46, 2.4.0 before 2.4.0p25, and 2.5.0 (bet...

CVE-2020-35881

creationtimestamp| type| source ---|---|--- 2026-04-07 11:43:13+00:00| seen| https://gist.github.com/soul2zimate/a5296bc917881b1c43c396b5caf75393...

CVE-2021-32715

creationtimestamp| type| source ---|---|--- 2026-04-07 11:43:13+00:00| seen| https://gist.github.com/soul2zimate/a5296bc917881b1c43c396b5caf75393...

CVE-2026-4420

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-4420

Summary: CVE-2026-4420 affects Bludit with a Stored XSS in the “page creating” flow. An authenticated user with page-creation privileges (Author/Editor/Admin) can insert a malicious script into the tags field when creating an article. The payload executes when a victim visits the uploaded resourc...

CVE-2026-4420 Stored XSS via Page Creating functionality in Bludit

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-4420

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-4420 Stored XSS via Page Creating functionality in Bludit

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-4420 Stored XSS via Page Creating functionality in Bludit

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-34903

creationtimestamp| type| source ---|---|--- 2026-04-07 10:25:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mivktshy7a2s...

CVE-2026-28810

creationtimestamp| type| source ---|---|--- 2026-04-07 10:11:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mivk27bqdq2t...

CVE-2026-34904

creationtimestamp| type| source ---|---|--- 2026-04-07 10:10:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivjysy4ag27 2026-04-07 10:35:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mivlfpd3jr2t 2026-04-07 13:55:24+00:00| seen|...

CVE-2026-33866

creationtimestamp| type| source ---|---|--- 2026-04-07 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/04/CVE-2026-33865/...

CVE-2026-31313

An authenticated stored cross-site scripting XSS vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Content field...

CVE-2026-39371

creationtimestamp| type| source ---|---|--- 2026-04-07 03:00:08+00:00| published-proof-of-concept| Telegram/c-9nM9mslhGNLfW7QsPDgkIMfnwsyr-9epKeORTrIU88Ta0 2026-04-07 20:22:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwm7gstkx2g 2026-04-07 21:22:30+00:00|...

EUVD-2026-19549

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio RES prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with...

PT-2026-30941

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting Stored XSS vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator...