CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

EUVD-2026-84070

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

PT-2026-96282

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.7.0 Description The post action component fails to escape user-controlled display names before they are interpolated into an HTML string passed to the trustHTML function. An attacker can set a crafted display...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime . The issue occurs when a downstream application enables the experimental slot fixes option and utilizes scoped components . Specifically, assigning a string to the textContent property of a...

PT-2026-96276

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description In the packages/renderer/MdToHtml/rules/fountain.ts file, HTML generated by the vendored fountain.js renderer is passed into the note output without sanitization. This...

PT-2026-96090

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A stored cross-site scripting XSS issue exists in the default theme's Galaxies index page. During synchronization, when unknown custom or default galaxy clusters are detected, the system displays sampl...

PT-2026-96718

Name of the Vulnerable Software and Affected Versions Check Point Security Management Server versions R81.10 through R82.20 Check Point Multi-Domain Security Management Server versions R81.10 through R82.20 Check Point Log Server versions R81.10 through R82.20 Check Point SmartEvent versions R81....

CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server

Symptoms - A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server. This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked. This...

CVE-2026-5410 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the usermetasave function scalar values bypass the sanitization logic that on...

CVE-2026-2422 WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

PT-2026-95758

Name of the Vulnerable Software and Affected Versions Botiga Pro versions prior to 1.6.5 Description Lack of authorization checks on a REST route allows unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and full site takeover...

PT-2026-95818

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7 Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is presen...

CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...

GHSA-3753-M2X2-Q623 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...