CVE-2026-32476: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-19852: Unrestricted Upload of File with Dangerous Type

NewSiteServer NSS developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting...

PT-2026-81030

A cross-site scripting XSS vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter...

CVE-2026-78290: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

PT-2026-80828

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-34491: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...

PT-2026-81057

Name of the Vulnerable Software and Affected Versions Toolset Blocks versions 1.6.26 and earlier Description Unauthenticated Cross-Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Toolset Blocks to...

CVE-2022-30983

A cross-site scripting (XSS) vulnerability exists in the Support chatbot of Nopaperforms Niaa-Chatbot (through version 2022-05-17). The root cause is the improper neutralization of input during web page generation, which allows remote attackers to inject arbitrary web script or HTML . This attack...

PT-2026-79823

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

CVE-2026-28166: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-78414: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-66623: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-78282: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...

CVE-2026-74793

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-7808

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

CVE-2026-8445

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-8445 justhtml before 1.12.0 Sanitizer Bypass via Markdown

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...