CVE-2026-76333: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

Mozilla Thunderbird < 153.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-80 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox E...

PT-2026-78489

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.4 Description A stored cross-site scripting issue exists in the comment-deletion notification flow. A Space administrator can exploit this by deleting another user's comment and inserting HTML or JavaScript into the deletio...

PT-2026-78773

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store a malicious script...

CVE-2026-76337: Improper Limitation of a Pathname to a Restricted Directory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...

PT-2026-80266

Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded...

CVE-2026-76325: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser o...

PT-2026-79965

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-14334: Improper Neutralization of Input During Web Page Generation

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-76367: Improper Neutralization of Input During Web Page Generation

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-67189: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink...

PT-2026-118178

Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge связана с использованием неинициализированного ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...

Linux Distros Unpatched Vulnerability : CVE-2026-74937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-74938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-74984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-74976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

Server-side Request Forgery (SSRF)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of JSON fields from an external API response in the device...

CVE-2026-63640

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:11+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8...

CVE-2026-74936

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...