EUVD-2026-89994

Satori-generated SVG has improper escaping...

EUVD-2026-109461

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allowrawhtml gate, executing JavaScrip...

Linux Distros Unpatched Vulnerability : CVE-2026-109266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived da...

CVE-2026-104828

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

EUVD-2026-102316

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

CVE-2026-110592

BottleCRM versions 0.30 through 1.14.5 are vulnerable to an HTML injection flaw within the render_invoice_template() function. This vulnerability allows authenticated organization members to inject malicious HTML and CSS markup into custom-template invoice PDFs by inputting specific strings into ...

SUSE CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

DEBIAN-CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

UBUNTU-CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

CVE-2026-109266

The ImageMagick image processing library versions prior to 6.9.13-57 and 7.x before 7.1.2-32 are vulnerable to XML injection within the CIP encoder . The root cause is the failure to properly escape input-derived data when generating Cisco IP Phone XML output . An attacker can provide a specially...

PT-2026-110683

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description An XML injection issue exists in the CIP encoder. The software fails to properly escape input-derived data when generating Cisco IP Phone XML output. Th...

CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-86833

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

EUVD-2026-94193

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

PT-2026-107419

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

DEBIAN-CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

CVE-2026-106106

The Quasar Framework contains a vulnerability in its SSR/SSG development error path where the renderSSRError() function in utils/render-ssr-error/src/index.js serializes sensitive data, including process.env , request headers, and cookies. Because the development server listens on all interfaces ...

CVE-2026-106102

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

Improper Neutralization Of Input During Web Page Generation

org.apache.wicket, wicket-core is vulnerable to improper neutralization of input during web page generation. The vulnerability is due to the resolver rendering attacker-influenced label values without escaping, which allows an attacker to inject malicious markup or script content into a web page...