PT-2026-66628

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard affected versions not specified Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

EUVD-2026-36077

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...