CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...

CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...

CVE-2026-61399

Apache CloudStack is affected by an Improper Encoding or Escaping of Output vulnerability in its UI when using the Lock User functionality . This flaw leads to a Cross-Site Scripting (XSS) issue, which allows an attacker to inject malicious scripts into web pages viewed by other users. The vulner...

CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

Splunk Enterprise’s vulnerabilities are exploited through Splunk

Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...

EUVD-2026-63826

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

CVE-2026-73537 is a cross-site scripting (CWE-79) vulnerability in the Miraikan Assist App provided by the Japan Science and Technology Agency (JST) . The flaw allows an arbitrary script to be executed in the app's WebView browser component, potentially altering displayed content. The vulnerabili...

Miraikan Assist App vulnerable to cross-site scripting

Overview Miraikan Assist App provided by Japan Science and Technology Agency JST contains the following vulnerability. Cross-site scripting CWE-79 - CVE-2026-73537 RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and coordinated. After the coordination was completed,...

EUVD-2026-63815

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

Cross-site Scripting (XSS)

Overview @dicebear/core is an An avatar library for designers and developers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were...

Cross-site Scripting (XSS)

Overview @dicebear/initials is an Initials avatar style for DiceBear Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were properly...

Fedora 44 : wordpress (2026-dc0ff85b8b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc0ff85b8b advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21593-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21593-1 advisory. Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead ...

openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21592-1 advisory. Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead...

PT-2026-79445

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web based IT service management tool. A Reflected Cross-Site Scripting XSS issue exists in the testing OQL Object Query Language query functionality. Reflected XSS occurs when ...

CVE-2026-73537: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-14325: Improper Neutralization of Input During Web Page Generation

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

PT-2026-79311

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...