EUVD-2026-91025

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-7176

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

CVE-2026-7175

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

CVE-2026-7176

The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...

CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

EUVD-2026-90746

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

CVE-2026-7175

The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...

CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

CVE-2026-103664

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

PT-2026-103774

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

CVE-2026-102667: Exposed Dangerous Method or Function

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-7175: Improper Neutralization of Input During Web Page Generation

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

PT-2026-103982

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1762361695)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762361695 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772617597)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772617597 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to...