EUVD-2026-72081

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be...

PT-2026-86573

Name of the Vulnerable Software and Affected Versions Projectwolds Online Attendance System version 1.0 Description A remote cross-site scripting issue exists in the profile.php file. The flaw allows for the manipulation of the email variable to execute malicious scripts in the context of the...

PT-2026-86532

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-86197

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

EUVD-2026-71999

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86197

Grav versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the Twig sandbox policy . The addJs and addCss methods on Grav\Common\Assets are allowlisted without proper output escaping, allowing page editors to inject arbitrary script by registering malicious assets or inject...

CVE-2026-86197 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86197 Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

EUVD-2026-72009

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188

AVideo installations with the YPTSocket plugin enabled are affected by an unauthenticated cross-site scripting (XSS) vulnerability. Attackers can send crafted WebSocket messages whose callback names resolve to global functions such as avideoConfirmHTML, which assign untrusted data to innerHTML, e...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

WordPress Masteriyo LMS plugin 1.18.0-2.3.3 - Instructor+ Stored XSS vulnerability

Instructor+ Stored XSS vulnerability discovered by Mutantgun in WordPress Plugin Masteriyo - LMS versions 1.18.0-2.3.3...

GHSA-JMR9-QJV8-65GV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

GHSA-QX2G-XRX7-VFH8 vulnerabilities

Vulnerabilities for packages: open-webui...

grafana-pcp security update

An update is available for grafana-pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...

buildah security update

An update is available for buildah. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...

CVE-2026-78849

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...