1124992 matches found
CVE-2026-15217
creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...
dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution
A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...
DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...
DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize function...
CVE-2026-3639
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639
CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...
PT-2026-71563
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
PT-2026-71593
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
PT-2026-71545
Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...
PT-2026-76573
Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...
PT-2026-71517
Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...
PT-2026-71508
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
PT-2026-71527
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
PT-2026-71576
Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...
PT-2026-71600
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
PT-2026-71502
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
PT-2026-71509
Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...
PT-2026-71521
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...