CVE-2026-15396

CVE-2026-15396 affects IBM WebSphere Application Server (traditional 8.5 and 9.0) and IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8). The root cause is improper parsing of the HTTP transfer-encoding request header (CWE-444), enabling HTTP request smuggling . An unauthentica...

CVE-2026-15634

CVE-2026-15634 is an HTTP request smuggling vulnerability (CWE-444) in IBM WebSphere Application Server 9.0, 8.5, and Liberty (17.0.0.3–26.0.0.8), caused by improper parsing of the HTTP transfer-encoding request header . A remote, unauthenticated attacker can send a specially crafted header to po...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...

CVE-2026-90795

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103

CVE-2026-4103 is a stored cross-site scripting (XSS) vulnerability in WSO2 API Manager's Publisher Portal and Developer Portal , caused by insufficient HTML sanitization that allows untrusted user input to be rendered without proper encoding or neutralization. When affected API documents are view...

CVE-2026-90795 itsourcecode Loan Management System navbar.php cross site scripting

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

CVE-2026-90795

itsourcecode Loan Management System 1.0 contains a cross-site scripting (XSS) vulnerability in navbar.php , triggered by manipulation of the page argument. The attack can be launched remotely over the network with no authentication required , though user interaction is needed to execute the scrip...

CVE-2026-90943

parallax/filament-comments (through 3.0.0 ) contains a stored cross-site scripting vulnerability in comment body rendering. The root cause is unescaped output in the comment display views (comments.blade.php) and policy layer, allowing authenticated panel users to inject malicious scripts into co...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notification message process in the login pages of Console and Enduser. An attacker can execute arbitrary JavaScript in the context of a user's browser by crafting a malicious HTTP link that injects unsa...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: delve security update

An update for delve is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-78318

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would then be interpreted as starting a separate attribute. If an...

Astra Linux – Vulnerability in Consul

The HashiCorp Consul and Consul Enterprise versions up to 1.9.4 had a key-value KV raw mode that was vulnerable to cross-site scripting attacks. This issue was fixed in versions 1.9.5, 1.8.10, and 1.7.14...

Astra Linux – Vulnerability in Tomcat9

In Apache Tomcat versions 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64, and 8.5.50 to 8.5.81, the Form authentication example in the sample web application displayed user-provided data without filtering, exposing an XSS vulnerability...

Astra Linux – Vulnerability in WebKit2GTK

A permissions issue has been addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4, and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Enhanced Tracking Protection’s Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS attacks through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames disguised as legitimate content. This...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing XSS payloads for action pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page, and can make arbitrary modifications to the contents of the page displayed to the victim. This attack can be...