CVE-2026-102771

A security vulnerability exists in Naichen ThinkCMF up to version 8.0.7 within the Email Template component. The flaw resides in the MailController::templatePut function of the file cmf-api/src/admin/controller/MailController.php. The root cause is the improper neutralization of special elements ...

Improper Neutralization of Special Elements in Data Query Logic

Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via GoogleDriveHook in drive.py, where folder names, fi...

CVE-2026-102771: Improper Neutralization of Special Elements Used in a Template Engine

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special...

CVE-2026-82969

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before...

CVE-2026-82969 Stored XSS in BİMSER's eBA Plus

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before...

EUVD-2026-87349

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100380

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100381

The Wikimedia Foundation Mediawiki - UploadWizard Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the Flickr collection and set titles allow for DOM XSS . This issue affects versions prior to 1.46.1 , 1.45.5 ,...

CVE-2026-96876

The Mediawiki - Cargo extension is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This specific vulnerability occurs within the CargoExport component during invalid-alias errors . The issue affects versions of the extension through 3.9.4 . No speci...

EUVD-2026-87204

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

CVE-2026-96874 Stored XSS in Cargo Drilldown tab names

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

EUVD-2026-87112

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

PT-2026-99121

Name of the Vulnerable Software and Affected Versions Mediawiki - TemplateSandbox Extension versions prior to 1.46.1 Mediawiki - TemplateSandbox Extension version 1.45.5 Mediawiki - TemplateSandbox Extension version 1.43.10 Description Improper neutralization of input during web page generation...

PT-2026-99125

Name of the Vulnerable Software and Affected Versions Mediawiki - UploadWizard Extension versions prior to 1.46.1 Mediawiki - UploadWizard Extension version 1.45.5 Mediawiki - UploadWizard Extension version 1.43.10 Description Improper neutralization of input during web page generation allows for...

CVE-2026-96875: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-100237: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

PT-2026-98937

Name of the Vulnerable Software and Affected Versions Mediawiki - Thanks Extension versions prior to 1.43.10 Mediawiki - Thanks Extension versions prior to 1.45.5 Mediawiki - Thanks Extension versions prior to 1.46.1 Description Improper neutralization of input during web page generation allows...

CVE-2026-96874: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

PT-2026-99102

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation leads to a stored cross-site scripting XSS issue. This occurs when the application fails to properly sanitize...

Improper Neutralization of Special Elements Used in a Template Engine

Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the parse method in trestle/core/jinja/tags.py, where...