9084 matches found
CVE-2026-102295
A cross-site scripting (XSS) vulnerability exists in Quay within the OAuth callback handler (specifically via the oauth local callback format=json parameter). The root cause is improper input sanitization , which allows a remote attacker to execute arbitrary JavaScript in a user's browser by tric...
CVE-2026-102295
A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...
Malicious code in chai-as-testmode (npm)
Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A self-executing IIFE POSTs the full process.env object to a...
PT-2026-106215
Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Authenticated users with file-edit permissions can upload SVG media containing scripts, event-handler attributes, and foreignObject elements that are stored without sanitization and served as...
PT-2026-106058
Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...
Malicious code in chai-as-testmode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...
CVE-2026-105089
WWBN AVideo versions through 29.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the application fails to escape the video trailer1 URL when rendered in YouPHPFlix2 templates and channel playlists. An attacker with upload permissions can inject a malicious ...
CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...
EUVD-2026-92110
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...
CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...
CVE-2026-105114
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...
CVE-2026-105090
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...
PT-2026-104575
Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...
CVE-2026-104907
MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...
CVE-2026-104906
MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...
CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...
CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...