CVE-2026-4103

CVE-2026-4103 is a stored cross-site scripting (XSS) vulnerability in WSO2 API Manager's Publisher Portal and Developer Portal , caused by insufficient HTML sanitization that allows untrusted user input to be rendered without proper encoding or neutralization. When affected API documents are view...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-90957

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

EUVD-2026-77467

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

USN-8756-1 yelp vulnerability

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

USN-8756-1: Yelp vulnerability

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

Astra Linux – Vulnerability in Thunderbird

When a worker is shut down, it was possible for the script to run late in the lifecycle, at a time when it should not be possible. This vulnerability affects Firefox 96, Thunderbird 91.6, and Firefox ESR 91.6...

Astra Linux – Vulnerability in Firefox

The SVG element could have been used to load unexpected content that might execute scripts under certain circumstances. Although the specification appears to allow this, other browsers do not do so. Web developers relied on this property for script security, so Gecko’s implementation was aligned...

Astra Linux – Vulnerability in Apache2

A substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attackers to execute scripts in directories permitted by the configuration, but these directories are not directly accessible via URLs. Additionally, the source of scripts intended for execution only as CG...

Astra Linux – Vulnerability in Apache2

There is a vulnerability in the core of the Apache HTTP Server version 2.4.59 and earlier. This vulnerability allows for information disclosure, SSRF attacks, or local script execution through backend applications whose response headers are malicious or exploitable. Users are recommended to upgra...

Astra Linux – Vulnerability in Firefox and Thunderbird

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could allow script execution when the allow-scripts flag is not set. This vulnerability affects Thunderbird version 91.9, Firefox ESR version 91.9, and Firefox version 100...

CVE-2026-82790

Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82792

Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82788

Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82776

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82781

Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82769

Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82771

Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82773

Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82763

Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...