11002 matches found
CVE-2026-88869
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...
PYSEC-2026-3817 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...
django CMS: Stored XSS in edit-mode plugin exception rendering
SummaryWhen plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short...
PYSEC-2026-3825 django CMS: Stored XSS in edit-mode plugin exception rendering
Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...
CVE-2026-88060: Improper Neutralization of Input During Web Page Generation
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...
CVE-2026-88058: Improper Neutralization of Input During Web Page Generation
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...
CVE-2026-88059: Exposure of Sensitive Information to an Unauthorized Actor
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...
PT-2026-89700
Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...
PT-2026-89571
Name of the Vulnerable Software and Affected Versions Angular versions prior to 20.3.30 Angular versions prior to 21.2.22 Angular versions prior to 22.1.4 Description Server-side rendering SSR in @angular/platform-server fails to properly escape matching ancestor closing tags when serializing...
PT-2026-89573
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...
PT-2026-89572
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...
CVE-2026-71803
money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...
CVE-2026-85630
A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...
CVE-2026-19855 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...
CVE-2026-49314
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...
EUVD-2026-74596
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-49314
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-49314
CVE-2026-49314 is an out-of-bounds (OOB) write vulnerability in the rendering and composition module of a Huawei consumer product, as indicated by the vendor support bulletin references (including a laptop-specific bulletin). The vulnerability is rated CVSS 7.3 (HIGH) with a local attack vector r...
CVE-2026-87620
A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Scalable Vector Graphics SVG rendering engine by enticing a user to open a specially crafted HTML page. This could lead to the disclosure of sensitive information...