8104 matches found
CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...
PT-2026-76681
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An unauthenticated attacker can inject arbitrary HTML into a page by sending a...
CVE-2026-55674: Improper Neutralization of Input During Web Page Generation
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...
Basecamp: One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML
A cross-account JavaScript execution vulnerability was discovered in a web application that allowed arbitrary code execution when a victim opened a crafted public board URL. An attacker with a separate account could leverage this vulnerability to steal the victim's write access token through a...
EUVD-2026-59800
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...
CVE-2026-73052
CVE-2026-73052 concerns SiYuan before v3.7.4. The issue arises because attribute-view field names are stored without HTML escaping and are interpolated into option elements via innerHTML in the sort menu. This allows stored XSS: an attacker can rename a database field to inject markup, which can ...
Mozilla: Arbitrary JavaScript execution in PDF.js
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...
CVE-2026-73572
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
Mozilla: Arbitrary JavaScript execution in PDF.js
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...
Important: Red Hat Security Advisory: webkit2gtk3 security update
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
EUVD-2026-58071
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
CVE-2026-73628 Serendipity 2.3.5 Reflected XSS via search clean-URL route
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
EUVD-2026-57821
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...
CVE-2026-73617
Budibase before 3.40.0 has a NoSQL injection in the MongoDB datasource integration. User-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering, allowing injection of MongoDB operators through query parameters. Impact described includes bypas...
CVE-2026-73037: Improper Neutralization of Input During Web Page Generation
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-49466
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
CVE-2026-73299
Prompty is a markdown file format .prompty for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype propertie...
Cross-site Scripting (XSS)
Overview mkdocs-material is a security holding package Affected versions of this package are vulnerable to Cross-site Scripting XSS via the mountSearchSuggest function. An attacker can execute arbitrary JavaScript in the context of the documentation site's origin by crafting a malicious q URL...