CVE-2026-65899

The CVE affects DOMPurify 3.0.0 through 3.4.8, where clearConfig() does not reset the retained TRUSTED_TYPES_POLICY. This allows a DOMPurify instance reused across trust boundaries to remain bound to a previously supplied policy, so a later caller requesting RETURN_TRUSTED_TYPE output may receive...

CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

CVE-2026-63281

Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...

Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaa5c1d1ed763b9e392bd199c360d75b25531b287de9f224e5626e121d649d4 Analysis of lebinfmt 1.0.0 surfaced no behaviors matching supply-chain attack classes. No install-time or import-time network I/O, no credential or...

EUVD-2026-42336

Mistune renderers/html.safeurl: HARMFULPROTOCOLS list misses legacy and chained schemes that historically chain to javascript: execution...

CVE-2026-15069

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation...

CVE-2026-15091

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation...

CVE-2026-15069

Summary: IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 are affected by a vulnerability that could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation. Affected products/versions: IBM Engineering AI Hub v1.0.0, v1.1.0, and v1...

CVE-2026-15091

CVE-2026-15091 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, where improper neutralization of input during web page generation could allow a remote attacker to execute arbitrary scripts. The connected IBM security bulletin confirms the issue and states a fix in version 1.3.0. I...

CVE-2026-15091 Multiple Vulnerabilities in IBM Engineering AI hub.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation...

EUVD-2026-45261

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation...

CVE-2026-9585

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...

SUSE SLES16 Security Update : python-mistune (SUSE-SU-2026:22655-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22655-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in...

PT-2026-60843

Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary scripts. This issue is a Cross-Site Scripting XSS flaw, where malicious...

CVE-2026-45368

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-47730

A flaw was found in Twig, a template language for PHP. The HtmlDumper component, responsible for rendering profiler information, does not properly sanitize user-controlled template or profile names before including them in the HTML output. This vulnerability allows an attacker to inject malicious...

CVE-2026-47429

A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading ...