CVE-2026-84463: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-63206: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-56731: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-18320: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-100176: Improper Neutralization of Input During Web Page Generation

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100174: Improper Neutralization of Input During Web Page Generation

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-88996: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

PT-2026-98898

🚨 CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could...

PT-2026-99081

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The HTML sanitizer used in ticket articles and email views fails to correctly identify and block remote images when a shortened URL format is used that omits the double slash after the scheme. Because...

PT-2026-98847

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The username timeline feature is susceptible to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an...

CVE-2026-56732: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

VulnCheck KEV: CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

PT-2026-98946

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the HTML sanitization process allows the injection of specific HTML elements into ticket bodies. When a user views a...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Bison vulnerability (USN-8777-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8777-1 advisory. It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker cou...

PT-2026-98945

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 Description An authenticated user with low privileges can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during the standard ticket creation process. This occurs because th...

MiracleLinux 9 : skopeo-1.22.2-8.el9_8 (AXSA:2026-1913:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1913:05 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the FormatsSanitizedValue sanitizer, which fails to restrict the srcdoc attribute on elements and incorrectly applies encoding bypass logic unconditionally when the RAWHTML toolbar button is present. An...

GHSA-J8R4-32C5-33RC xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...