GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075

n8n's editor splices resource-locator field values into node URL templates without expression-syntax checks, enabling an authenticated user to inject JavaScript evaluated in another user's session. CVSS 8.4 HIGH. Affected: <1.123.69, 2.x <2.33.4, 2.34.x

PT-2026-78931

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description An expression injection issue exists in the link preview rendering of the resource-locator field. The editor directly splices the...

CVE-2025-48495: Improper Neutralization of Input During Web Page Generation

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0,...