CVE-2026-8630

justhtml versions ≤ 1.11.0 contain a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements (, [removed]). When sanitize_dom() is invoked with a custom policy that retains these elements, text nodes inside them are serialized without escaping, allowing an attacker to inject a...

CVE-2026-8630

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

EUVD-2026-64660

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

PT-2026-79777

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0 Description A mutation cross-site scripting mXSS issue exists during the serialization of raw-text elements, such as and . When the sanitize dom function processes a DOM tree using a custom policy that retains...

Packet-Sniffer v4.0.0

Packet Sniffer A network traffic monitor for GNU/Linux. Frames are captured from a network interface with a raw socket, decoded layer by layer with the NETProtocols library, and rendered on screen as they arrive: root@kitploit: Frame 4 at 15:42:07 wlan0, 74 bytes + Ethernet 3c:7c:3f:1a:be:22 -...

Exploit for SQL Injection in Mikro-Orm Mikroorm

CVE-2026-43220 MikroORM SQL Injection ★ CVE-2026-43220 Mikro...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

CVE-2026-75948

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

PT-2026-78900

Name of the Vulnerable Software and Affected Versions iCagenda versions 4.0.8 through 4.0.12 Description The frontend Submit an Event form allows authenticated users to perform a Stored Cross-Site Scripting XSS attack. This occurs because the image and file fields are stored as raw strings withou...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2025-14603

vsDesk is vulnerable to blind SQL injection due to insecure handling of user-supplied parameters that are passed directly into SQL queries. An unauthenticated remote attacker can exploit this over the network with low complexity to potentially expose database contents or render the application un...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-44252

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...