Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Summary The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears captionsContainer.innerHTML and then appends each active cue with captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the...

PT-2026-95461

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions 3.1.0 through 6.x Description Stored Cross-Site Scripting XSS is possible through wikitext because the extension inserts the unsanitized value of a data attribute into the Document Object Model DOM as HTML...

CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without...

EUVD-2026-82316

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card eventgeneral.ctp and the server/feed preview card previewgeneral.ctp constructed donut chart legend labels by directly concatenating object name or category keys into an...

CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without...

CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

GHSA-XHQ9-WHGQ-49J5 Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

EUVD-2026-81670

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459

Vendure (open-source headless commerce platform) prior to 3.6.5 contains a stored XSS in its Admin Dashboard. The RichTextDescriptionCell component strips HTML by assigning an administrator-controlled description field to a live element's innerHTML and then reading textContent. This pattern still...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

CVE-2026-93296: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without...

PT-2026-95008

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the Overmind theme's statistics views. The event General card event general.ctp and the server/feed preview card preview general.ctp create donu...

PT-2026-94343

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description Stored cross-site scripting XSS exists in the admin dashboard due to unsafe HTML stripping in the RichTextDescriptionCell component within...

CVE-2026-63459: Improper Neutralization of Input During Web Page Generation

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

PT-2026-95108

Name of the Vulnerable Software and Affected Versions Paella Player versions prior to 2.12.11 Opencast versions prior to 19.7 Opencast versions prior to 20.2 Description An issue exists where the player renders caption cue text into innerHTML without proper escaping. This allows a user with conte...