Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption process. An attacker can execute arbitrary JavaScript in the context of users' browsers by supplying crafted input that is rendered without proper sanitization. Details Cross-site scripting or XS...

CVE-2026-46594

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

CVE-2026-46594

A reflected XSS vulnerability affects the PHP Jabbers - PHP Poll Script. A crafted URL can trigger arbitrary JavaScript execution in the victim’s browser. The issue is resolved in version 4.1; upgrading to 4.1 or later is recommended. The available documents do not provide exploitation status, sp...

EUVD-2026-51527

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

CVE-2026-46594

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

CVE-2026-14928

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...

WordPress JS Help Desk plugin < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure vulnerability

Subscriber+ Cross-User Support Ticket Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin JS Help Desk versions 3.1.5...

CVE-2026-15209 JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

WordPress JS Help Desk plugin < 3.1.4 - Contributor+ User Email Disclosure vulnerability

Contributor+ User Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin JS Help Desk versions 3.1.4...

CVE-2026-14930

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...

CVE-2026-14833

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...

SUSE CVE-2026-3495

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those...

SUSE CVE-2026-17658

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17729

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17807

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-58039

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

CVE-2026-17989

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520017306...

PT-2026-66711

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

PT-2026-66848

Name of the Vulnerable Software and Affected Versions Jodit Editor versions prior to 4.12.31 Description The sanitizeHTMLElement function fails to properly normalize javascript: values within href attributes before validating the scheme. While other URL attributes are processed using the...

CVE-2026-62324: Improper Neutralization of Input During Web Page Generation

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...