EUVD-2026-64248

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917

JoomGallery (a Joomla extension) versions prior to 4.3.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with privileged access can embed an XSS payload in any image, resulting in JavaScript execution in the browser of every visitor who views the affected ...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-43980

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

CVE-2026-69236

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...

CVE-2026-69234

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69234 reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69234

Esri Portal for ArcGIS versions 11.5 and prior contain a reflected cross-site scripting (XSS) vulnerability. A remote, unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS 3.1 score is 6.1 (Medium) with...

EUVD-2026-64161

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

EUVD-2026-64086

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...

CVE-2026-69236 stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...

EUVD-2026-64082

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...

CVE-2026-69232

Esri Portal for ArcGIS versions 11.5 and prior are affected by a stored cross-site scripting (XSS) vulnerability. A remote, privileged attacker can inject malicious code that executes arbitrary JavaScript in a victim's browser. The CVSS 3.1 score is 5.5 (MEDIUM) , reflecting the high privilege re...

CVE-2026-69232 stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...

CVE-2026-69231 stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are...

CVE-2026-69231

Esri Portal for ArcGIS versions 11.5 and prior are affected by a stored cross-site scripting (XSS) vulnerability. A remote, privileged attacker can inject malicious code that executes arbitrary JavaScript in a victim's browser. The CVSS 3.1 score is 5.5 (Medium) , reflecting the high privilege re...

CVE-2026-77811 Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...

CVE-2026-64971

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

EUVD-2026-63372

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...