CVE-2026-92134

The Jenkins Warnings Plugin (warnings-ng) version 13.10258.va_17d49a_78c3b_ and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The root cause is a failure to validate the analysis results ID when a job configuration is submitted via the REST API , allowing an attacker with I...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

EUVD-2026-80190

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

EUVD-2026-80068

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...

CVE-2026-15639

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...

PT-2026-93291

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-92134: Improper Neutralization of Input During Web Page Generation

Jenkins Warnings Plugin 13.10258.va17d49a78c3b and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site...

CVE-2026-92135: Improper Neutralization of Input During Web Page Generation

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

Stored XSS vulnerability in warnings-ng

warnings-ng uses analysis results IDs to create the links to analysis results on the Jenkins UI. warnings-ng 13.10258.va17d49a78c3b and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permissio...

Stored XSS vulnerability in coverage

coverage uses coverage results IDs to create the links to coverage results on the Jenkins UI. coverage 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use...

GitLab 19.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-19619)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

CVE-2026-84088: Improper Neutralization of Input During Web Page Generation

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-61597: Improper Neutralization of Input During Web Page Generation

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...

CVE-2026-85386: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

CVE-2026-63325: Improper Control of Generation of Code

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-93301

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-92784: Improper Control of Generation of Code

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-88593: Improper Neutralization of Input During Web Page Generation

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts...