CVE-2022-23861

CVE-2022-23861: Множественные сохраненные межсайтовые скрипты в YSoft SafeQ Множество полей в веб-приложении YSoft SafeQ могут использоваться для внедрения вредоносных входных данных, которые из-за отсутствия очистки вывода приводят к выполнению произвольного JS-кода. Эти поля могут быть...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 — это уязвимость типа «хранимая межсайтовая инъекция сценариев» Stored XSS, затрагивающая Mautic 7 версии с 7.0.0 по 7.1.1. Недостаток присутствует в компоненте Projects, где имена проектов отображаются на административных страницах таких как кампании, письма и формы в...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-78364

The MW WP Form WordPress plugin, in versions prior to 5.1.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain form settings before they are rendered on an admin dashboard page. This flaw allows users with permissions as low ...

EUVD-2026-67052

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-4259

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

CVE-2026-4336

The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling htmlentitydecode on postcontent during rendering in the setdisplayvariables function View.FAQ.class.php, line...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-3108

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...

CVE-2026-1454

Affected product: WordPress plugin “Responsive Contact Form Builder & Lead Generation Plugin” (Lead Form Builder); vulnerable in all versions up to 2.0.1. Root cause: insufficient input sanitization in lfb_lead_sanitize() (omits certain field types from its whitelist) and an overly permissive wp_...

CVE-2025-15312

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

CVE-2025-15312

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

EUVD-2025-206830

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

CVE-2025-15312

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

CVE-2025-15312 Tanium addressed an improper output sanitization vulnerability in TanOS.

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

CVE-2025-15312

CVE-2025-15312 describes an improper output sanitization vulnerability in Tanium Appliance (TanOS family) that affects output handling in the affected component. The public records consistently cite “improper output sanitization” as the root cause, with CVSS metrics indicating high impact to conf...

PT-2026-6606

Name of the Vulnerable Software and Affected Versions Tanium Appliance affected versions not specified Description Tanium Appliance is affected by an improper output sanitization issue. This could potentially allow for unintended consequences due to unsanitized output. Recommendations At the...