PT-2026-76943

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists where the system fails to bind the authenticated principal on the gRPC transaction executor thread within the beginTransaction function. This allows authenticated users with read-on...

CVE-2026-75831: Improper Neutralization of Input During Web Page Generation

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-74938: Protection Mechanism Failure

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74936: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74936: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-77222

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the loadTemplate...

CVE-2026-23935: Out-of-bounds Read

A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...

CVE-2026-75843: Improper Privilege Management

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

CVE-2026-74984: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-73426: Improper Neutralization of Input During Web Page Generation

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...

CVE-2026-45115: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-15371: Improper Handling of URL Encoding (Hex Encoding)

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

EUVD-2026-61096

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-76961

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A flaw in the script item or preprocessing JavaScript HttpRequest logic allows a Zabbix administrator to read out-of-bounds memory, which may result in a loss of confidentiality. Recommendatio...

CVE-2026-45118: Improper Neutralization of Script in Attributes in a Web Page

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-52606

The software reportico-web (version

PT-2026-76970

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A use-after-free issue exists in the JavaScript: GC component. Use-after-free is a memory...

PT-2026-77017

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A race condition exists in the JavaScript Engine component. A race condition is a situation whe...