CVE-2026-126451 OpenEMR before 8.5.0 Stored XSS via Document Template Rendering

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document templatedata. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by...

CVE-2026-126451

OpenEMR versions prior to 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw during Document Template Rendering . The root cause is the DocumentTemplateRender function, which fails to sanitize an encounterForm value rendered into an iframe src. This allows portal patients to inject ...

CVE-2026-126954

The Glance application (versions 0.7.9 before 0.8.8 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of proper input neutralization, allowing malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. An attacker contr...

EUVD-2026-125111

Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title,...

CVE-2026-121447

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

EUVD-2026-115869

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API javascript: URLs

Contributor+ Stored Cross-Site Scripting via Interactivity API javascript: URLs vulnerability discovered by Luis Herranz in WordPress core versions = 7.1.3...

CVE-2026-116169

The SiYuan note-taking application (versions 2.10.0 before 3.8.7 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs when KaTeX trust is enabled, allowing users with edit permissions to inject javascript: URLs into math block content. Specifically, the mathRender functio...

CVE-2026-116169 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that...

PT-2026-123010

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store href, url, or includegraphics payloads that...

SiYuan cross-site scripting vulnerability

Versions of SiYuan from 2.10.0 through 3.8.7 contain a cross-site scripting vulnerability. This vulnerability arises because, when KaTeX trust rendering is enabled, the javascript: URLs placed within mathematical block content are not adequately validated. Users with editing privileges can inject...

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

GHSA-CV27-6WVH-8X7J ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661

The ApostropheCMS content management system is affected by a vulnerability in the sanitize-html library. Prior to version 2.18.0 , a non-default configuration allowing meta refresh elements could retain unsafe javascript: or data: URLs within the content attribute. This flaw can lead to unsafe sc...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

Astra Linux – Vulnerability in jsoup

jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and XSS Cross-Site Scripting protection. However, jsoup may incorrectly sanitize HTML containing javascript: URLs, which could allow XSS attacks when a user clicks on those links. If the non-default...

CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109288

The Open WebUI software (versions before 0.11.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the MarkdownInlineTokens.svelte component. The root cause is the failure to validate URL schemes when rendering markdown link URLs into anchor hrefs. An authenticated user can embed java...