CVE-2026-56731

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

EUVD-2026-87216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-56731

The open-source helpdesk system Zammad is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 7.0.1 . A low-privilege authenticated user can inject arbitrary HTML markup , including JavaScript event handlers , into a ticket title through the standard ticket creation workflow. Thi...

CVE-2026-18320

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in the article body sanitization component. The root cause is a sanitize-html configuration that uses a wildcard attribute rule, permitting all attributes on SVG and PATH elements. This allows scri...

EUVD-2026-87231

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-18320 CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2025-13401-XSS-Stored

概念验证：Autoptimize 标签。 在版本 3.1.13 中，该函数采用“黑名单”方法（通过 pregreplace）在将原始 标签转换为 标签之前，移除特定属性如 title、alt、class、id、width 和 height。然而，它未能移除事件处理属性如 onload 或 onerror。 经过身份验证的攻击者（至少拥有贡献者角色）可以在帖子中嵌入恶意的 标签。当插件处理该帖子以生成预加载链接时，恶意的事件处理程序被保留并注入到页面 中的 标签内。由于 支持 onload 事件，当资源加载时，JavaScript 会执行。 漏洞代码（v3.1.13） //...

CVE-2026-92498

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

AZL-102903 CVE-2026-92498 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498 wifi: ath6kl: avoid buffer overreads in WMI event handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

EUVD-2026-82119

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498 wifi: ath6kl: avoid buffer overreads in WMI event handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498

This vulnerability affects the Linux kernel 's ath6kl (Atheros 6K) wireless driver. Three WMI event handlers—ath6kl_wmi_scan_complete_rx() , ath6kl_wmi_addba_req_event_rx() , and ath6kl_wmi_delba_req_event_rx() —read from the event buffer without first verifying that the message is large enough t...

CVE-2026-92498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-61592

djust is a reactive server-side rendering library for Django providing Phoenix LiveView-style functionality with Rust-powered performance. Prior to version 1.0.7 , its SSE (Server-Sent Events) transport keyed sessions solely by a client-chosen session_id with no binding to the authenticated user ...

EUVD-2026-81301

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-89241: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...

CVE-2026-84701

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...