PT-2026-56330

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Embedded JavaScript within a PDF can delete pages, rendering the object invalid. The application crashes when it attempts a write operation on these invalid pop-...

PT-2026-56337

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A crash occurs when the application opens a PDF and JavaScript deletes a form field object, followed by an attempt to access that invalid object. Recommendation...

PT-2026-56342

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description During page opening and form formatting, a JavaScript reentrancy—a situation where a function is interrupted and called again before its first execution completes—leads to an...

PT-2026-56355

Name of the Vulnerable Software and Affected Versions Foxit Editor/Reader affected versions not specified Description When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, which are repeated after the form is reset. The application fails ...

PT-2026-56339

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crash occurs when the application opens a PDF file and JavaScript deletes PDF fields. The subsequent logic continues to use old field pointers, leading to...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...

CVE-2026-57238: Use After Free

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash...

CVE-2026-36163

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

GHSA-86J7-9J95-VPQJ Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirecturi in oidc-provider and mcp vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.13...

Open Redirect

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Open Redirect via the redirectURI value returned from the consent response in the authorization flow. An attacker can execute arbitrary JavaScript in the...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

EUVD-2026-42103

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

EUVD-2025-13498

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions...

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's...