CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

The Drupal Monster Menus module (versions 0.0.0 through 9.5.3 ) is vulnerable to a Stored Cross-site Scripting (XSS) issue. The root cause is the module's failure to sufficiently sanitize HTML code within the page name when it is rendered in the built-in tree browser . This allows an attacker, wh...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

EUVD-2026-69996

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

CVE-2026-81160 Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

CVE-2026-81160

The Drupal Slick Carousel module (versions 0.0.0 through 2.1.0 ) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is a lack of sufficient validation for user input within Slick option sets that contain HTML for c...

CVE-2026-81160 Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-84793

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

Security Bulletin: IBM Edge Data Collector component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector component uses multiple third-party libraries which are vulnerable to several security vulnerabilities. The CVE details are listed below in the Vulnerability Details section. This bulletin provides information about the affected components and the remediation for...

SUSE CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

SUSE CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84793

Craft CMS versions from 5.0.0-RC1 through before 5.10.11 are affected by a stored cross-site scripting (XSS) vulnerability in the site name field . The root cause is a failure to sanitize input in that field, allowing privileged administrators to inject arbitrary JavaScript payloads that execute ...

EUVD-2026-69905

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...