CVE-2026-61597 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...

CVE-2026-61597

djust is a Django library providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance. Prior to version 1.0.7 , its built-in component template tags (djust.components.templatetags.*) HTML-escape user-supplied URLs via conditional_escape but never validate the URL...

Cross-site Scripting (XSS)

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of user-supplied URLs in...

CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92135

The Jenkins Coverage Plugin (version 3.3358.v9487dde48783 and earlier) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the failure to validate the coverage results ID when a job configuration is submitted via the REST API , allowing an attacker with Item/Configure per...

EUVD-2026-80759

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92134

The Jenkins Warnings Plugin (warnings-ng) version 13.10258.va_17d49a_78c3b_ and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The root cause is a failure to validate the analysis results ID when a job configuration is submitted via the REST API , allowing an attacker with I...

Stored XSS vulnerability in coverage

coverage uses coverage results IDs to create the links to coverage results on the Jenkins UI. coverage 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use...

Stored XSS vulnerability in warnings-ng

warnings-ng uses analysis results IDs to create the links to analysis results on the Jenkins UI. warnings-ng 13.10258.va17d49a78c3b and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permissio...

EUVD-2026-78169

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146

Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

PT-2026-91744

Name of the Vulnerable Software and Affected Versions Takahe versions prior to 0.11.1 Description The software fails to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote actors to inject javascript: links. When clicked, these malicious link...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

ImpactBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

CVE-2026-88859: Improper Neutralization of Encoded URI Schemes in a Web Page

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-86550: Improper Neutralization of Input During Web Page Generation

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

PT-2026-87016

NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websit...