75439 matches found
SUSE CVE-2026-74984
Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
PT-2026-79469
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.2 Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This could lead to the execution of arbitrary JavaScript within the browse...
PT-2026-79467
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This could lead to the execution of arbitrary JavaScript within the browse...
CVE-2026-69236: Improper Neutralization of Input During Web Page Generation
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...
CVE-2026-69234: Improper Neutralization of Input During Web Page Generation
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...
CVE-2026-69231: Improper Neutralization of Input During Web Page Generation
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...
CVE-2026-63135: Improper Neutralization of Input During Web Page Generation
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2026-77811: Improper Neutralization of Input During Web Page Generation
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...
PT-2026-79485
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A reflected cross site scripting issue exists that allows a remote, unauthenticated attacker to create a crafted link. If a victim clicks this link, arbitrary JavaScript code may be...
PT-2026-79451
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...
PT-2026-79468
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6 Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This could lead to the execution of arbitrary JavaScript within the browse...
CVE-2026-43980: Improper Neutralization of Input During Web Page Generation
Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...
PT-2026-80232
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to: - overwriting $clone allowing mutation of objects via transforms see evaluateTransformExpression - it being possible to destruct jsonata functions/lambdas e.g. $merge. - applyProcedure using...
PT-2026-79846
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color scheme id or dark scheme id cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was render...
Zabbix 7.0.x < 7.0.28 / 7.4.x < 7.4.12 OOB Read (ZBX-28073)
The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.28, or 7.4.x prior to 7.4.12. It is, therefore, affected by an out-of-bounds read vulnerability: - A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScrip...
Zabbix Server 6.0.x < 6.0.47 / 7.0.x < 7.0.27 / 7.4.x < 7.4.11 DoS (ZBX-28075)
The version of Zabbix Server installed on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.27, or 7.4.x prior to 7.4.11. It is, therefore, affected by a denial of service vulnerability: - An authenticated administrator is able to crash Zabbix server by creating specifically crafted...
CVE-2026-75933: Improper Neutralization of Input During Web Page Generation
Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...
CVE-2026-69232: Improper Neutralization of Input During Web Page Generation
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...
