html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.35 packages and security update

Red Hat OpenShift Container Platform release 4.21.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270

The software is vulnerable to HTML injection , where malicious HTML content can be injected into the help texts of various fields. This vulnerability is accessible to users with organizer permissions . No specific affected product versions or remediation steps are provided in the documents.

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

EUVD-2026-88752

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

Cross-site Scripting

Apache Wicket is vulnerable to Cross-site Scripting. The vulnerability is due to improper neutralization of input during web page generation, where user-supplied input is included in generated HTML without proper escaping and attackers can inject malicious script payloads that execute in the...

[SECURITY] Fedora 44 Update: perl-HTML-FormFu-2.07-23.fc44

HTML::FormFu is a HTML form framework which aims to be as easy as possible to use for basic web forms, but with the power and flexibility to do anything else you might want to do as long as it involves forms...

[SECURITY] Fedora 43 Update: perl-HTML-FormFu-2.07-22.fc43

HTML::FormFu is a HTML form framework which aims to be as easy as possible to use for basic web forms, but with the power and flexibility to do anything else you might want to do as long as it involves forms...

CVE-2026-102372

Versions of GestSup prior to 3.2.62 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the IMAP LOGIN connector . The root cause is a failure to properly sanitize HTML email bodies, which allows unauthenticated attackers to inject arbitrary JavaScript into ticket descriptions and r...

EUVD-2026-88582

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

CVE-2026-102366

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

[SECURITY] Fedora 45 Update: perl-HTML-FormFu-2.07-24.fc45

HTML::FormFu is a HTML form framework which aims to be as easy as possible to use for basic web forms, but with the power and flexibility to do anything else you might want to do as long as it involves forms...

PT-2026-102702

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 1.5.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An XSS filter bypass exists in the InputFilter. The cleanAttribute function fails to properly remove HTML data URIs when whitespace characters are...

PT-2026-102421

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Insufficient sanitization of HTML email bodies within the IMAP LOGIN connector allows unauthenticated attackers to perform a stored cross-site scripting attack. By sending emails to the monitored...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95280): chromium -- security fixes

Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-102847

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A UI misrepresentation issue exists in the TabStrip component. This allows a remote attacker to spoof UI elements by using a specially crafted HTML page. Recommendations Update Google...

PT-2026-102840

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.92 Description An uninitialized resource in Dawn allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome on Android to...

PT-2026-102852

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description An uninitialized resource in the GPU allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. Recommendations...