CVE-2026-28315

CVE-2026-28315 affects SolarWinds Serv-U. It is an authenticated stored cross-site scripting (XSS) vulnerability that could allow session hijacking or information disclosure from an administrator account. Root cause: stored XSS. CVSSv3.1: AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N (base score 6.2, MEDIU...

EUVD-2026-46295

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account...

CVE-2026-28315 SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account...

CVE-2026-64823

CVE-2026-64823 affects Home Assistant Core prior to 2026.5.4 via the Shelly integration’s async_get_media_image(), where a data: URI with text/html can bypass the image-only allowlist. The vulnerability enables an attacker controlling a Shelly device’s thumb field to cause the media proxy endpoin...

CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

EUVD-2026-46280

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

EUVD-2026-46267

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-65048

CVE-2026-65048 affects the Ninja Forms WordPress plugin (versions 3.10.4–3.14.9). The issue arises in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly i...

CVE-2026-65048 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-65048 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol SNMP monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection...

CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

RUSTSEC-2026-0213 XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs. Applications that do not...

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628

Grav (CVE-2026-64628) suffers a stored XSS in shortcode-core attribute handlers. The XSS bypasses validation because the detector only flags payloads with literal angle brackets, allowing shortcode parameters to inject JavaScript that runs in any viewer’s browser, including admins. Attackers with...

Cross-site Scripting (XSS)

Astro is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping of user-controlled values in transition:persist, transition:scope, and transition:persist-props directives, which allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered...

CVE-2026-15145

The CVE concerns the WordPress plugin Essential Addons for Elementor (Lite) with versions up to 6.6.11. It describes a Stored Cross-Site Scripting (XSS) via the Fancy Text Widget caused by insufficient input sanitization/output escaping. Exploitation requires at least Contributor+ privileges (aut...

EUVD-2026-46166

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15145

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...