CVE-2026-91021 CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-73195

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-73195

The Apache Syncope identity management tool is vulnerable to an Improper Encoding or Escaping of Output vulnerability. Authenticated users can inject a spreadsheet formula payload into their own plain attributes. If these users are subsequently included in a CSV export , the formula may execute w...

CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

USN-8753-1: libinput vulnerability

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

USN-8753-1 libinput vulnerability

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

PT-2026-91841

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

PT-2026-91188

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

FreeBSD : yt-dlp: Improper Neutralization of Special Elements (cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0 advisory. https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports: yt-dlp and youtube-dl...

CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

BIT-TOMCAT-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or...

CVE-2026-88021

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

CVE-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

CVE-2026-88021

Consul and Consul Enterprise contain an authorization bypass in the Connect service mesh . When generating Envoy RBAC rules to enforce Connect intentions, Consul failed to correctly escape certain characters in service names , namespaces , and partitions , causing the resulting authorization rule...

CVE-2026-88886

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions='gradleWrapper', ..., a...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to Improper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34479 Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard,...

EUVD-2026-74713

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...