PT-2026-103676

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

PT-2026-103991

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...

CVE-2026-103266: Incorrect Authorization

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

PT-2026-103799

Name of the Vulnerable Software and Affected Versions Ghost versions 5.2.0 through 6.61.0 Description An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of conte...

PT-2026-105077

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

JetBrains YouTrack versions prior to 2026.2.18991 are vulnerable to stored HTML injection . The vulnerability is triggered through the User-Agent header , allowing for the injection of malicious HTML content. The impact is categorized as Medium severity, with a CVSS score of 4.7 . Remediation is ...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

EUVD-2026-90007

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

CVE-2026-101270

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270

The software is vulnerable to HTML injection , where malicious HTML content can be injected into the help texts of various fields. This vulnerability is accessible to users with organizer permissions . No specific affected product versions or remediation steps are provided in the documents.

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

EUVD-2026-88752

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

PT-2026-102518

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270: Improper Neutralization of Input During Web Page Generation

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...