CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

JLFSTS

██╗██╗ ███████╗███████╗████████╗███████╗ ██║██...

toxssin

toxssin Scopo toxssin è uno strumento open-source di penetration testing che automatizza il processo di sfruttamento delle vulnerabilità Cross-Site Scripting XSS. Consiste in un server https che funge da interprete per il traffico generato dal payload JavaScript dannoso che alimenta questo...

CVE-2026-107323 Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

CLEANSTART-2026-PG50954 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node

Security vulnerability affects the n8n package. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node...

Handlebars 4.7.9 JavaScript Injection

Handlebars version 4.7.9 and prior versions through 3.0.0 contain a JavaScript injection issue where an own-property check can expose the Function constructor during controlled template rendering with allowProtoMethodsByDefault enabled, leading to server-side code execution...

PT-2026-109666

Name of the Vulnerable Software and Affected Versions openapi-typescript-codegen versions prior to 0.31.1 Description Code injection occurs when the software processes an OpenAPI document containing unescaped values interpolated into single-quoted string literals. An attacker controlling the...

CVE-2026-108551: Improper Control of Generation of Code

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-106139: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo UI for Vue @progress/kendo-vue-charts starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a...

PT-2026-109637

Name of the Vulnerable Software and Affected Versions Kendo UI for Vue @progress/kendo-vue-charts versions 2.5.0 through 16.1.0 Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileg...

PT-2026-117826

Security vulnerability affects the n8n package. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node...

PT-2026-109609

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields author facebook, author twitter, author linkedin, author dribble, author whatsapp, author email in versions...

GHSA-PWHX-CVV3-QJ5C Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

retire.js

Retire.js Retire Status Ciò che richiedi, devi anche ritirarlo Esiste una pletora di librerie JavaScript utilizzabili sul Web e nelle app Node.JS. Questo semplifica enormemente lo sviluppo, ma dobbiamo rimanere aggiornati sulle correzioni di sicurezza. "L'utilizzo di componenti con vulnerabilità...

SUSE CVE-2026-94448

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile or precompile allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the...

CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template...

CVE-2026-4264

Reflected Cross-Site Scripting XSS on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the...