CVE-2026-92059

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the DOM: Editor component...

PT-2026-95145

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description An issue exists where the getThemeFolder function in admin/controller/editor/revisions.php returns the theme parameter without proper sanitization. The backupFolder function then concatenates this...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2026-66626: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2021-3030

The Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) due to improper validation of the Theme GET parameter within the /CuteSoft_Client/CuteEditor/Dialogs/colorpicker_more.aspx component. A remote, unauthenticated attacker can craft a malicious URL that, when opene...

EUVD-2021-34881

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

PT-2026-95081

Name of the Vulnerable Software and Affected Versions Cute Editor for ASP.NET version 6.4 Description Reflected cross-site scripting occurs due to improper validation of the Theme GET parameter in the 'colorpicker more.aspx' endpoint. A remote, unauthenticated attacker can craft a URL that, when...

PT-2026-95142

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description The oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl. The validateUrl function in system/functions.php only checks the...

CVE-2026-54613: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54612: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2021-3030: Improper Neutralization of Input During Web Page Generation

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

CVE-2026-76154: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

CVE-2026-88976

Plate (a rich-text editor with AI and shadcn/ui support) is vulnerable to a stored cross-site scripting (XSS) issue in its core HTML deserialization APIs. Prior to 53.3.11 , and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, supplied HTML strings are parsed in the active document...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-19619

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-19619

CVE-2026-19619 affects GitLab CE/EE versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper sanitization of pasted HTML content in the Content Editor . Under certain conditions, an unauthenticated attacker ...

CVE-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...