UBUNTU-CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-116139

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

CVE-2026-116139

WWBN AVideo versions 26.0 through 29.3.0 are vulnerable to a stored cross-site scripting (XSS) flaw within the comment markdown rendering process. The root cause is that the markDownToHTML() function preserves event-handler attributes in leading HTML blocks. This allows authenticated commenters t...

CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

EUVD-2026-109544

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

World Wide Broadcast Network AVideo Cross-site Scripting Vulnerability

In versions AVideo 26.0 through 29.3.0 of the World Wide Broadcast Network, there is a cross-site scripting vulnerability. This vulnerability arises because MarkdownToHTML retains event handling attributes within HTML blocks, allowing authenticated commenters to inject JavaScript. Attackers can...

PT-2026-122980

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerro...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

DEBIAN-CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the onerror handler in src/virtualenv/util/path/sync.py during directory tree removal on Windows. When a read-only file or directory cannot be deleted, the handler widens the entry's permissions using os.chmod before...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the onerror handler in src/virtualenv/util/path/sync.py, which previously called os.chmod on a path without first checking whether it is a symbolic link. On Windows, when a read-only file cannot be deleted during a tr...

SUSE CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

DEBIAN-CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

UBUNTU-CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

CVE-2026-105224 YesWiki before 4.6.7 Stored XSS via Bazar valeur Action

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup...