CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue

In Progress® Kendo UI for Vue @progress/kendo-vue-charts starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a...

CVE-2026-106138 Cross-Site Scripting via Chart Tooltip in KendoReact

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

EUVD-2026-95478

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A stored Cross-Site Scripting (XSS) vulnerability exists in the login theme rendering component of Keycloak . The flaw arises because the security filter intended to sanitize user input can be bypassed, enabling a realm administrator to inject malicious scripts into display fields. If exploited, ...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

PT-2026-108987

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101 Description The /web/ endpoint in src/pyload/webui/app/blueprints/app blueprint.py renders Jinja2 templates without requiring authentication, bypassing the @login required protection applied to direct...

CVE-2026-107889: Improper Neutralization of Input During Web Page Generation

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

EUVD-2026-95137

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

EUVD-2026-94866

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...

Server-side Request Forgery (SSRF)

Overview weasyprint is a The Awesome Document Factory Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via EPS image rendering in weasyprint/images.py, which invokes Ghostscript to process EPS images. An attacker who can supply a malicious EPS image to be...

CVE-2026-80903

A flaw was found in the Linux kernel's Direct Rendering Manager DRM Xe output/audio OA module. When a specific configuration emission function fails, it does not properly release allocated memory for synchronization entries. This oversight leads to a memory leak, where system memory becomes...

XSS-via-XML-Rendering

XSS via XML document This repo showcases how to exploit XH...

CVE-2026-106336

An observable discrepancy flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522722456...

ROS-20261007-73-0075

The vulnerability of the intelenginesresetdefaultsubmission function in the drivers/gpu/drm/i915/gt/intelenginecs.c file of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to...

UBUNTU-CVE-2026-101258

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

CVE-2026-106445

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...