EUVD-2026-102154

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CentOS Linux 7 [TuxCare] Security Update: python-lxml / python-lxml-docs (CENTOS7:CLSA-2024:1729629058)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1729629058 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafte...

CVE-2026-12559 Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting...

CVE-2026-12559: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting...

CVE-2026-16881

The LINE Android app (before 26.7.2) contains a vulnerability in the profile rendering component where externally supplied script content embedded in profile templates is not adequately validated or sandboxed. This can allow crafted profile content to execute arbitrary code with the app’s privile...

GHSA-2PPX-66JV-WPW5 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Summary A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/workspace/scripts/listsearch. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware...

CVE-2026-44580

A flaw was found in Next.js. A remote attacker could exploit this cross-site scripting XSS vulnerability by injecting untrusted content into beforeInteractive scripts. Due to improper escaping of serialized script content, this could allow the attacker to execute arbitrary JavaScript code in a...

CVE-2026-44580

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escap...

PT-2026-33091

Name of the Vulnerable Software and Affected Versions Cisco Webex Contact Center affected versions not specified Description An issue in the Desktop Agent functionality allows an unauthenticated remote attacker to perform cross-site scripting XSS, which is a technique where malicious scripts are...

Duplicate Advisory: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8g75-q649-6pv6. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are no...

EUVD-2021-0117

Malware in sbrugna...

EUVD-2017-14564

Malware in sbrugna...

Mozilla: Cross-origin responses could be distinguished between script and non-script content-types

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn...

Mozilla: Cross-origin responses could be distinguished between script and non-script content-types

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn...

Mozilla: Cross-origin responses could be distinguished between script and non-script content-types

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn...

Mozilla: Cross-origin responses could be distinguished between script and non-script content-types

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn...

CVE-2023-40370

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-40370

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

Cross site request forgery (csrf)

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-40370 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...