CVE-2026-124694

The Kendo UI for jQuery component, specifically the PropertyGrid , is vulnerable to Cross-Site Scripting (XSS) in versions 2026.3.1015 up to, but not including, 2026.4.1110 . The root cause is that the component fails to encode bound property values and the items[].description field in its defaul...

CVE-2026-124693

The Kendo UI for jQuery component (versions 2026.3.1015 up to but not including 2026.4.1110 ) contains a Cross-Site Scripting (XSS) vulnerability in the PivotGrid and PivotConfigurator components. The root cause is the lack of appropriate encoding when axis field names are passed to a chip templa...

CVE-2026-124692

In Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 , a vulnerability exists in the Grid and TreeList components. The root cause is that the column-reorder drag clue reparses header text as HTML. An attacker capable of influencing a column field or title can trigger ...

CVE-2026-124689

Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, are vulnerable to Cross-Site Scripting (XSS) via the ActionSheet component. The root cause is the failure to encode title , subtitle , and header button label values before rendering. An attacker capable of i...

FOQUZ Platform XSS

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

FOQUZ Platform XSS

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

CVE-2026-40853

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-40853 Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-40853

The Apache XML Graphics Batik library (versions through 1.19 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is the presence of unencoded font metadata within the SVGFont component. This vulnerability allows for the execution of malicious scripts in a web context. To mitigate this ...

EUVD-2026-123472

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: containernetworking-plugins security update

An update for containernetworking-plugins is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

EUVD-2026-123519

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: from n/a through 6.9.1...

CVE-2026-118413

Apache Roller versions 4.0 through 6.1.6 are vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is that blogroll links imported from an OPML file are not validated, and the default theme renders these links without pr...

EUVD-2026-123515

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme...