CVE-2025-65754

CVE-2025-65754 : Algernon 1.17.4におけるStored XSS 説明 Algernon v1.17.4は、攻撃者が巧妙に細工されたペイロードをファイル名に注入することで任意のコードを実行できるクロスサイトスクリプティング（XSS）の脆弱性の影響を受けます。 影響を受けるプロジェクト : Algernon - 1.17.4 プロジェクトメンテナ : Alexander F. Rødseth xyproto 脆弱性タイプ : クロスサイトスクリプティング（XSS） 攻撃ベクトル :...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-68528

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-redcarpet (UTSA-2026-032342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032342 advisory. Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting...

CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

Cross-site Scripting (XSS)

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Cross-site Scripting XSS via the replaceAsyncValues render path in lib/hbs.js. An attacker can inject script into rendered HTML by supplying attacker-controlled data to a...

AZL-88397 CVE-2026-44708 affecting package python-mistune for versions less than 3.2.1-1

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

PT-2026-37294

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description An issue exists where the 'plugin/Meet/iframe.php' endpoint echoes the user and pass query parameters unescaped into a JavaScript double-quoted string literal within a block. This allows an attacker to...