CVE-2026-103585 attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting XSS. This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43...

CVE-2026-103585

A basic Cross-Site Scripting (XSS) vulnerability exists in The Wikimedia Foundation MediaWiki MediaSearch extension due to the improper neutralization of script-related HTML tags. This vulnerability affects versions 1.46, 1.45, and 1.43 . The impact allows for the execution of arbitrary scripts i...

CVE-2026-103584 attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

CVE-2026-102126

A stored cross-site scripting XSS weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected pag...

EUVD-2026-90269

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2026-102100 Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2026-102100

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This weakness allows an authenticated user to submit malicious content that executes arbitrary JavaScript when viewed by another user within their authenticated session. Such exploitation could enab...

EUVD-2026-90383

A stored cross-site scripting XSS weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full...

Exploit for CVE-2026-103445

CVE-2026-103445: Stored XSS through PageForms autoedit Rep...

CVE-2026-103437

The MediaWiki ReadingLists extension (versions 1.46 and 1.45 ) is vulnerable to a Reflected XSS flaw due to the improper neutralization of Script-Related HTML tags. This issue specifically allows JavaScript URL execution via imported metadata . The impact includes the potential for unauthorized s...

CVE-2026-103443

The MediaWiki Collection (Book) extension by The Wikimedia Foundation is vulnerable to a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This issue allows for XSS Targeting Non-Script Elements . The vulnerability specifically affects versions 1.46, 1.45, and 1....

CVE-2026-103443 API permits session-seeded javascript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...

EUVD-2026-89027

Serialize JavaScript: Cross-site scripting XSS via unescaped in serialized function bodies...

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

NPM: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

NPM: Serialize JavaScript: Cross-site scripting XSS via unescaped in serialized function bodies vulnerability discovered by ? in WordPress Npm serialize-javascript versions = 7.1.1, 7.1.2...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

EUVD-2026-88468

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages...

CVE-2026-103388

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...