PT-2026-98846

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The tag selector component located at var/www/static/js/tags.js is susceptible to stored cross-site scripting XSS. An authenticated user with permissions to create custom tags can embed...

MongoDB Server-Side JavaScript Engine Data Compromise

The vulnerability of the server-side JavaScript engine of the MongoDB database management system is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-67237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or...

CVE-2026-6088: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

PT-2026-98343

Name of the Vulnerable Software and Affected Versions madpsy ka9q ubersdr versions prior to 0.1.58 Description A stored cross-site scripting XSS issue exists in the chat message rendering functionality. User-controlled URLs in chat messages are insufficiently neutralized before being converted in...

PT-2026-98364

Name of the Vulnerable Software and Affected Versions AMP for WP versions prior to 1.1.17 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. The issue occurs during Regex Transformation,...

CVE-2025-14814: Improper Neutralization of Input During Web Page Generation

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-6086: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6085: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6083: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

PT-2026-98348

Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description Stored Cross-Site Scripting occurs via the cjtoolbox shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with...

PT-2026-98945

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 Description An authenticated user with low privileges can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during the standard ticket creation process. This occurs because th...

PT-2026-98837

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A stored cross-site scripting XSS issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: var/www/templates/chats explorer/block message.ht...

CVE-2026-88388

Espruino 2v29 commit bffc6d0 contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker, which passes the address of a 4-byte...

CVE-2026-48540

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48541

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48542

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing...

CVE-2026-48543

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

EUVD-2026-86448

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

EUVD-2026-86446

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing...