Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Overview A cross-site scripting XSS vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG Scalable Vector Graphics objects in ICS iCalendar invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTota...

WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits

Description WordPress does not properly escape user display names in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the affected admin screens...

CVE-2026-28141: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

CVE-2026-61963: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-66707: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...

CVE-2026-66663: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2926)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

CVE-2026-18968

CVE-2026-18968 affects ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. The vulnerability is in processing of the file /tags.php where manipulation of the day argument enables cross site scripting. The attack could be performed remotely, and the exploit has been publicly disclosed....

CVE-2026-18968

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by alexhenry20 in WordPress Plugin LatePoint versions = 5.3.2...

Exploit for CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Lea...

CVE-2026-70440

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

Security Bulletin: Langflow OSS is affected by stored cross-site scripting in image file handling

Summary Langflow OSS serves user-provided image content as part of its file handling features. Improper handling of SVG image content could allow stored script execution when malicious image files are viewed, which may expose session information or permit actions in the context of another user...

DRUPAL-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70440

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...