CVE-2026-78252

GitLab CE/EE versions from 15.3 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by improper sanitization of user-controlled data in the Markdown JSON table renderer . Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-...

CVE-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-92213

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-92214 a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site...

CVE-2026-92214

CVE-2026-92214 affects a2ui-project a2ui versions up to 0.10.7 , specifically the file sanitizer-markdown-renderer-service.ts within the a2a-chat-canvas Angular component. The vulnerability is a Cross-Site Scripting (XSS) flaw in an unknown function of that service. A remote attacker with low pri...

CVE-2026-92214 a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site...

EUVD-2026-80072

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site...

CVE-2026-92213

a2ui-project a2ui (versions up to 0.10.6) is affected by an injection vulnerability in the Angular Renderer component. The vulnerable code is located in the function z.any within the file renderers/web_core/src/v0_9/schema/server-to-client.ts. By manipulating the primaryColor argument, a remote a...

EUVD-2026-80071

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-78252: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-92775: Server-Side Request Forgery (SSRF)

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

GitLab 15.3 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-78252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could ha...

PT-2026-93250

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.8 Description A flaw in the a2a-chat-canvas component allows a remote attacker to perform cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue...

CVE-2026-92213: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

PT-2026-93228

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web core/src/v0 9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible...