73893 matches found
CVE-2026-55691 EmbedVideo Extension : Stored XSS via unsanitized class passed to template
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class...
CVE-2026-55692 EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...
CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...
CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...
CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...
CVE-2026-87793
The "Design Scuole Italia" WordPress theme (versions 1.0–2.18.2 ) contains a Reflected Cross-Site Scripting (XSS) vulnerability in the filters-scheda-didattica.php file. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by supplying a malicious value in the archiv...
CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...
SUSE-SU-2026:23784-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.2.0 ESR MFSA 2026-85 bsc1278001: CVE-2026-75874 bmo2039972 Sandbox escape in the Remote Settings Client component CVE-2026-84118 bmo2057457 Use-after-free in the JavaScript: GC component CVE-2026-84119...
rabbitmq-server: rabbitmq-server: Sensitive credential disclosure via unauthenticated JavaScript endpoint
A flaw was found in rabbitmq-server. When OAuth2 authentication is enabled for the management interface, the server inadvertently exposes the configured client secret within an unauthenticated JavaScript file. A remote, unauthenticated attacker with access to the management interface can retrieve...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92021
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
DEBIAN-CVE-2026-92021
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
UBUNTU-CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
UBUNTU-CVE-2026-92021
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
CVE-2026-92021
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
