CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, class, id, width, and height from the...

CVE-2026-92409

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

PT-2026-108911

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-79363

Cloudron versions 9.1.7 and 9.2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Branding Footer feature. An authenticated administrator can exploit this by storing crafted HTML containing JavaScript event handlers in the Footer setting. Because the application fail...

CVE-2026-105798

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...

PT-2026-106755

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group documents/upload stores an attacker-controlled group document filename that group workspaces.html later interpolates into inline Share even...

PYSEC-2026-4044 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

Impact The SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POS...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

PT-2026-105801

Impact The SSE client→server POST endpoints are @csrf exempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and PO...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2024_6681)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246681 advisory. firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces were...

CVE-2026-56731

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

EUVD-2026-87216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-56731

The open-source helpdesk system Zammad is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 7.0.1 . A low-privilege authenticated user can inject arbitrary HTML markup , including JavaScript event handlers , into a ticket title through the standard ticket creation workflow. Thi...

EUVD-2026-87231

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-18320

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in the article body sanitization component. The root cause is a sanitize-html configuration that uses a wildcard attribute rule, permitting all attributes on SVG and PATH elements. This allows scri...

CVE-2026-18320 CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

SUSE CVE-2026-92498

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92498

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...