CVE-2026-71249: Improper Neutralization of Input During Web Page Generation

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71286: Improper Neutralization of Special Elements Used in a Template Engine

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...

PT-2026-68572

Name of the Vulnerable Software and Affected Versions WPIDE – File Manager & Code Editor versions prior to 3.5.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

CVE-2026-71233: Improper Neutralization of Input During Web Page Generation

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...

PT-2026-68513

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.23.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute whe...

CVE-2026-70588

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...

CVE-2026-44705

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

CVE-2026-67618

The vulnerability CVE-2026-67618 affects marimo before version 0.23.15. It stems from insufficient sanitization in sanitize_pyproject_dict, allowing a notebook author to inject a malicious base_url via PEP-723 inline script metadata. The attacker-controlled base_url is merged into session configu...

EUVD-2026-52702

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

CVE-2026-67618 marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

SpEL Expression Injection

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests. The vulnerability is due to the JSON Pointer path segment used as the map key being embedded directly into a SpEL expression without sanitization or validation, where...

[SECURITY] Fedora 44 Update: rust-ammonia-4.1.4-1.fc44

HTML Sanitization...

PT-2026-68529

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.39 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which...

PT-2026-68571

Name of the Vulnerable Software and Affected Versions Advanced AJAX Product Filters versions prior to 3.2.0.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages...

PT-2026-67657

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

PT-2026-67863

Name of the Vulnerable Software and Affected Versions Ghost versions 5.26.0 through 6.54.0 Description The Universal Import feature in Ghost Admin fails to properly sanitize imported content, which leads to Cross-Site Scripting XSS within post content. XSS is a security flaw where malicious scrip...

SUSE CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

CVE-2026-38446

A stored cross-site scripting XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding...