CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the DebugFormatter process. An attacker can execute arbitrary scripts in the context of the user's browser by crafting a malicious query that injects unescaped HTML or JavaScript into the debug output. This ...

GHSA-HG8H-557G-Q8PP Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Summary The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Details In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of t...

CVE-2026-1031 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2026-1025 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2025-36147

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.16 are vulnerable to cross-site scripting (CWE-79) . The root cause is that the security configuration lacks specific content security directives , relying instead on a broad fallback policy in ...

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the...

CVE-2026-92976 Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0

A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...

CVE-2025-13533

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

CVE-2025-13533 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

EUVD-2025-210931

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

CVE-2025-13533 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

CVE-2025-13533

The CSS & JavaScript Toolbox WordPress plugin (all versions up to and including 12.0.6 ) is vulnerable to Stored Cross-Site Scripting via the Assignment Engine fields. The root cause is insufficient input sanitization and output escaping on assignment data fields including Expressions , URLs , an...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

Malicious Package

Overview link-bootes-framework-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

SUSE CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

PT-2026-95309

Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. The issue exists within the Assignment Engine...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 3 Stored XSS (CVE-2026-69236)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - A stored cross site scripting issue exists in Esri Portal for ArcGIS that may allow a remote,...

CVE-2026-84992: Improper Neutralization of Input During Web Page Generation

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-91127: Improper Neutralization of Input During Web Page Generation

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...