CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361: withastro astro: Astro is a web framework for content-driven websites

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

PT-2026-146084

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-50080

Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request...

EUVD-2026-122693

Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request...

CVE-2026-50080

A Stack-based Buffer Overflow exists in the ACPI event handler of the QNX Virtual Machine (QVM) , affecting QNX Hypervisor and QNX Hypervisor for Safety . An attacker residing in a guest environment could crash the QVM by transmitting a crafted ACPI request . The vulnerability is associated with ...

PT-2026-144433

Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request...

CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...

CVE-2026-111037

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111037

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The root cause is the lack of proper output encoding or sanitization for the list_item_function parameter, which is reflected in the server's response and embedded directl...

EUVD-2026-116821

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111037 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-116797

A flaw was found in Highcharts Grid Pro. Cross-Site Scripting XSS can occur when an attacker who controls table column configurations injects malicious event-handler attributes into rendered input elements. When a user interacts with or edits an affected cell, the injected script executes in thei...

WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Event Handler Bindings

Description WordPress does not sanitise event-handler values bound through Interactivity API directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session. This also affec...

Cross-site Scripting (XSS)

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the breadcrumbs.style option, which is passed to SVGElement.attr rather than applied as CSS. An...

GHSA-35RR-XWFH-X789 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Impact The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live...

npm: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

npm: Highcharts Core: breadcrumbs.style keys become SVG event-handler attributes vulnerability discovered by ? in WordPress npm highcharts versions = 10.0.0, 11.4.9...

CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API Event Handler Bindings

Contributor+ Stored Cross-Site Scripting via Interactivity API Event Handler Bindings vulnerability discovered by Jon Surrell in WordPress core versions = 7.1.3...