html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 packages and security update

Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

EUVD-2026-78368

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-54477

CVE-2026-54477 : Panneau d'administration sans en-têtes de sécurité clickjacking / XSS Avis Champ| Valeur ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Moyen Vecteur 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vecteur 4.0|...

BIT-RCLONE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-50229

⚡ CVE-2026-50229 — Apache Tomcat Examples XSS Exploit...

CVE-2026-91846

MISP (≤2.5.45) contains a missing authorization check when adding collection elements from a bare UUID. Because collection elements only store UUIDs that are resolved later by the collection view, the generic add() path could persist a UUID for an Event or Galaxy Cluster that the acting user coul...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Défaut d'autorisation inter-locataire et inter-utilisateur IDOR / BOLA dans le service de validation de commande Checkout de la plateforme VTEX Commerce. Champ| Valeur ---|--- Identifiant CVE| CVE-2026-52217 Fournisseur| VTEX Produit| Plateforme VTEX Commerce, service Checkout chk...

CVE-2026-46558

CVE-2026-46558 Le sous-système d'actifs V2 de Plane faisait confiance aux slugs d'espaces de travail et aux UUID d'actifs sans appliquer les vérifications d'appartenance appropriées, ce qui permettait à un utilisateur authentifié de lire, copier, supprimer et écraser des actifs dans d'autres...

CVE-2026-50338

CVE-2026-50338 Contournement de l'authentification inter-émetteurs du serveur de ressources B2C Spring Cloud Azure Description AadB2cResourceServerAutoConfiguration dans spring-cloud-azure-autoconfigure construit un JwtDecoder qui fait confiance à six émetteurs de la famille AAD...

CVE-2025-24076

CVE-2025-24076 Microsoft Windows Cross Device Service - Exploitation de vulnérabilité d'élévation de privilèges Aperçu Ce script exploite une vulnérabilité dans le service Cross Device de Windows qui permet une élévation de privilèges sur les systèmes Windows 11 , Windows Server 2025 et Windows...

CVE-2026-90850

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-90848

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5...

DEBIAN-CVE-2026-90848

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5...

CVE-2022-43332

CVE-2022-43332 Межсайтовый скриптинг в WonderCMS Описание: Уязвимость межсайтового скриптинга XSS в Wondercms v3.3.4 позволяет потенциальным злоумышленникам выполнять произвольные веб-сценарии или HTML через вредоносную полезную нагрузку, внедрённую в поле "Название сайта" панели конфигурации — в...

CVE-2022-3942

CVE-2022-3942 Cross-Site Scripting dans Sanitization Management System Description : Une vulnérabilité de cross-site scripting XSS dans Sanitization Management System v1.0 permet à des attaquants potentiels d'exécuter des scripts web ou du HTML arbitraire via une charge utile payload conçue et...

CVE-2026-57830

Helix Ultimate Framework — Traversée de chemin non authentifiée Lecture/Suppression arbitraire de fichiers/dossiers Il s’agit d’un DoS confirmé + accès au système de fichiers inter-tenant, PAS d’une RCE. Une théorie d’escalade RCE supprimer configuration.php pour réexposer l’installateur Joomla a...

EUVD-2026-78252

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-90850 PHPGurukul Hostel Management System manage-students.php cross site scripting

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...