CVE-2026-111037

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111037

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The root cause is the lack of proper output encoding or sanitization for the list_item_function parameter, which is reflected in the server's response and embedded directl...

EUVD-2026-116821

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111037 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-106149 Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149 Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149 Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

PT-2026-91061

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-19723: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-55839: Improper Neutralization of Input During Web Page Generation

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-15385: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-42841: Improper Neutralization of Input During Web Page Generation

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...

EUVD-2016-6213

Malware in sbrugna...

EUVD-2022-27902

Malicious code in bioql PyPI...

EUVD-2022-5827

Malicious code in bioql PyPI...

CVE-2022-22759

If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox 97, Thunderbird 91.6, and...

Google Chrome 74.0.3729.0 / 76.0.3789.0 - Heap Use-After-Free in blink::PresentationAvailabilityState::UpdateAvailability

iterating&iteratinglisteners, true; for auto& listenerref : availabilitylisteners auto listener = listenerref.get; if !listener-urls.Containsurl continue; auto screenavailability = GetScreenAvailabilitylistener-urls; DCHECKscreenavailability != mojom::blink::ScreenAvailability::UNKNOWN; for auto...