73998 matches found
CVE-2026-92021: Use After Free
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
CVE-2026-39038
BharatMLStack version v1.3.0 and below is vulnerable to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the trufflebox-ui component, specifically in the GenericNumerixTable.jsx file. Exploitation of this vulnerability could allow an attacker to execute malicious scripts in the ...
PT-2026-93222
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Reflected Cross-Site Scripting issue exists where an attacker can craft a malicious link. If a legitimate user interacts with this link, it may cause the user...
ROS-20260915-73-0125
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...
CVE-2026-81927: Improper Neutralization of Input During Web Page Generation
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...
CVE-2026-55692: Improper Neutralization of Input During Web Page Generation
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...
PT-2026-91976
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Thunderbird versions prior to 156 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a memory corruption flaw that occurs when an application continues to use a...
CVE-2026-17495: Path Traversal: 'dir/../../filename'
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...
CVE-2026-91922: Improper Neutralization of Input During Web Page Generation
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...
CVE-2026-57138: Incomplete List of Disallowed Inputs
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...
CVE-2026-62280: Improper Neutralization of Input During Web Page Generation
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
CVE-2026-92040: Use After Free
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92021: Use After Free
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...
CVE-2026-91146
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...
CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...
CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...
CVE-2026-91146
Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...
CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...
CVE-2026-7884
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...
EUVD-2026-78138
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...