PT-2026-82880

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

PT-2026-83252

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-81814

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

EUVD-2026-67014

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814

Flowintel is vulnerable to stored XSS in its calendar view. Calendar event titles are derived from case titles and rendered via innerHTML , allowing a user who can create or modify a case title to inject HTML or script-capable content that executes in the browser of another user viewing the calen...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814: Improper Neutralization of Input During Web Page Generation

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

PT-2026-82502

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-47665

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47666

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

EUVD-2026-66812

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47665

Penpot , an open-source design and prototyping platform, is affected by a stored cross-site scripting vulnerability in versions up to and including 2.14.3 . Comment content on shared files is stored as raw text and rendered via innerHTML without sanitization; the backend applies only a length che...

CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-47666

Penpot (open-source design and prototyping platform) versions up to and including 2.14.3 are affected by a stored XSS via custom font family names. Arbitrary font-family strings are interpolated into a @font-face CSS rule and injected via innerHTML without sanitization, allowing an attacker to br...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...