CLEANSTART-2026-SM05133 protobufjs compiles protobuf definitions into JavaScript (JS) functions

CVE-2026-44292 affects multiple packages. protobufjs compiles protobuf definitions into JavaScript JS functions. See references for individual vulnerability details...

CLEANSTART-2026-RU46318 protobufjs compiles protobuf definitions into JavaScript (JS) functions

CVE-2026-45740 affects multiple packages. protobufjs compiles protobuf definitions into JavaScript JS functions. See references for individual vulnerability details...

CLEANSTART-2026-DD82894 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node

CVE-2026-102282 affects multiple packages. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node. See references for individual vulnerability details...

CLEANSTART-2026-LA61588 Picomatch is a glob matcher written JavaScript

CVE-2026-33672 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-CI36044 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48816 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-FS67325 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48758 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-YO55047 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48815 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-YT71369 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CVE-2014-125132: Improper Neutralization of Input During Web Page Generation

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with maliciou...

PT-2026-120136

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

PT-2026-118334

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:4736-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4736-1 advisory. Update to Mozilla Thunderbird 153.5 MFSA 2026-110, bsc1284493: - CVE-2026-109704: Privilege escalation in the...

PT-2026-118249

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

PT-2026-118506

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

PT-2026-120341

Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...

PT-2026-120294

Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...

PT-2026-118348

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...

CVE-2026-4413

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (XSS) (CWE-79). This flaw allows users to embed arbitrary JavaScript code within the Web UI, which can alter intended functionality and potentially lead to credentials disclosure during a trusted session. The...