CVE-2026-59281

Spring Framework versions from 5.2.25.RELEASE through 7.0.8 are vulnerable to a reflected cross-site scripting (XSS) flaw in Spring MVC and WebFlux applications. The root cause involves data-binding Errors instances with HTML escaping enabled: when field errors are rendered using the no-argument ...

CVE-2022-2398

The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...