CVE-2026-103585

CVE-2026-103585: Stored XSS in MediaSearch QuickView Reporter: Marco Paciaroni BomboBombone. MediaSearch QuickView used CommonsMetadata's LicenseUrl.value directly as a link destination. CommonsMetadata copied the licensetpllink value from an editable file description without restricting its URL...

CVE-2026-103445

CVE-2026-103445: Stored XSS through PageForms autoedit Reporter: Marco Paciaroni BomboBombone. PageForms used the redirect parameter as a generated link's href without rejecting executable schemes. An editor with ordinary page-edit permission could save a javascript: URL that ran when a visitor...

EUVD-2026-107413

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled...

NPM: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

NPM: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled vulnerability discovered by ? in WordPress npm nuxt versions 4.6.0...

CVE-2026-34212

CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130

The Nuxt web development framework for Vue.js is vulnerable to a cross-site scripting (XSS) issue prior to version 4.6.0 . When the pages feature is disabled, the no-pages router incorrectly classifies an attacker-controlled input as an internal route if it is prefixed with an ASCII C0 control ch...

PT-2026-120733

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.0 Description An incomplete fix allows applications with pages disabled to render a script-capable URL through NuxtLink. This occurs when attacker-controlled input bound to the to variable is prefixed with an ASCII C...

element-fragment-guest

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · element-fragment-guest element-fragment-guest Element Web v1.12.29 - Element / New Vector Class: Session destruction Reach: Remote Lifecycle.loadSession prefers guestuserid and guestaccesstoken from the URL hash over...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

EUVD-2026-103005

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

PT-2026-116112

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.37.0 Description A cross-site scripting issue exists because the getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates the unprefixed version of the...

CVE-2026-109131

The Ansible Automation Platform UI (based on upstream ansible-ui ) is vulnerable to stored cross-site scripting (XSS) due to an unsafe handling of URL schemes in the Hub collection module documentation renderer. Specifically, the formatPartURL function in DocumentationParsers.tsx renders document...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-107380

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

EUVD-2026-95137

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-104078

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...

CVE-2026-107380: Improper Neutralization of Input During Web Page Generation

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

PT-2026-108043

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description A filter bypass exists in the bundled MathJax 3.2.2 Safe component. An attacker can execute arbitrary code by embedding a crafted href value containing a TAB byte in the URL scheme. This...

Linux Distros Unpatched Vulnerability : CVE-2026-59788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in th...