CVE-2026-126209

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.alloweduri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing wher...

CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...

CVE-2026-112365

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-112365

The easy.jobs WordPress plugin (versions up to and including 2.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'cover_letter' parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For...

CVE-2026-112365 easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-112365 easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2026-105456

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

EUVD-2026-114128

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456

The RTIR extension for Request Tracker (RT) introduces a Stored XSS vulnerability due to a flawed HTML scrubber rule. The extension allows internal link placeholders but incorrectly permits any link containing that placeholder, including those using the javascript: scheme. This change affects the...

Keycloak Vulnerable To Cross-site Scripting (xss) Via Case-insensitive Uri Validation Bypass

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with "manage-client" permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious...

CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

Best Practical Solutions RT for Incident Response Cross-site Scripting Vulnerability

Versions 5.0.0 through 5.0.11 and 6.0.0 through 6.0.4 of Best Practical Solutions RT contain a cross-site scripting vulnerability. This vulnerability arises because the HTML cleaner in the RT extension for RT allows internal link placeholders without filtering links that contain only such...

PT-2026-133623

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...

EUVD-2026-39473

Keycloak vulnerable to cross-site scripting xss via case-insensitive uri validation bypass...

GHSA-V3F7-2P4R-MWFW Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...

PT-2026-133252

Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...