CVE-2026-16485

SourceCodester Class and Exam Timetabling System 1.0 suffers a cross-site scripting (XSS) vulnerability in /class.php via manipulation of the day parameter. The issue can be exploited remotely and the exploit has been disclosed publicly. No additional technical details (such as exact payloads, af...

CVE-2026-16485 SourceCodester Class and Exam Timetabling System class.php cross site scripting

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-47058

Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful...

CVE-2026-47057

Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attack...

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...

CVE-2026-47685

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization, and the Host Management Inventory page...

CVE-2026-47689

FOGProject prior to versions 1.5.10.1832 and 1.6.0-beta.2313 is vulnerable to stored XSS. The buildRow() function in fogpage.class.php inserts data into HTML templates via str_replace() without escaping. An unauthenticated attacker who knows a registered host’s MAC address can POST malicious inve...

CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-47687

FOGProject vulnerability CVE-2026-47687: an unauthenticated attacker who knows a registered host MAC can post a crafted sysproduct to /service/inventory.php, causing the selectForm() helper to render unescaped input in option labels. This stored value is eventually displayed when an administrator...

CVE-2026-47685

FOGProject vulnerable to stored cross-site scripting (XSS) in the Host Management Inventory page due to two issues disclosed across connected sources: (1) unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization; and (2) the Host Manag...

CVE-2026-47685 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization, and the Host Management Inventory page...

CVE-2026-50758

Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081

DHIS2 OpenAPI HTML endpoint is vulnerable to reflected XSS via the scope parameter. The OpenAPI UI renders crafted scope values without sufficient sanitization, enabling an attacker to execute JavaScript in a victim’s DHIS2-origin browser when a user opens the affected OpenAPI HTML URL. Affected ...

GHSA-W62V-XXXG-MG59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within IBM HTTP Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration...

CVE-2026-44227

A flaw was found in RT, an issue and ticket tracking system. This reflected Cross-Site Scripting XSS vulnerability allows a remote attacker to execute arbitrary JavaScript code in an authenticated user's browser session. This can happen if an attacker convinces an authenticated user to visit a...

CVE-2026-44228

A flaw was found in RT, an issue and ticket tracking system. This stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript code into the system. When another user views the affected page, the injected script executes, potentially leading to...

CVE-2026-64823

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...