1144516 matches found
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...
CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181
This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...
CVE-2026-94682: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...
CVE-2026-94168: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
CVE-2026-95957: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...
ALSA-2026:70641 Important: skopeo security update
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...
CVE-2026-95530: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...
PT-2026-97467
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
CVE-2026-91928: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
PT-2026-97484
Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...
PT-2026-97522
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.6 through 7.2.0 Description An authenticated actor with system set permission can perform a stored cross-user cross-site scripting XSS attack. By sending a request to the 'POST /openc3-api/screen' endpoint, an attack...
CVE-2026-91999: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
CVE-2026-94461: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-94391: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...
AlmaLinux 9 : podman (ALSA-2026:69961)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...
RHEL 9 : containernetworking-plugins (RHSA-2026:70391)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70391 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network...
RockyLinux 9 : podman (RLSA-2026:69961)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...