Cross-site Scripting (XSS)

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the displayforfield function. An attacker can execute arbitrary JavaScript code in the context of th...

WordPress SKT Skill Bar plugin <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin SKT Skill Bar versions = 2.6...

WordPress DTX – Dynamic Text Extension for Contact Form 7 plugin <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by SATYARTH PRAKASH XoxoL33t in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...

WordPress Simple Yearly Archive plugin <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Simple Yearly Archive versions = 2.2.4...

WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

UBUNTU-CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

SNOMED International Snowstorm reflected XSS

RISK EVALUATION SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. The function does not properly validate user input, allowing an attacker to inject arbitrary JavaScript which will execute upon a target user navigating to a...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

Django 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by a cross-site scripting issue in django.contrib.admin.utils.display_for_field() that renders URLField values as clickable links without validating the URL. If an unsafe URL is already stored (e.g., via direct queryset writes, deserializ...

EUVD-2026-52750

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. "django.contrib.admin.utils.displayforfield" renders "URLField" values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admi...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-10032

The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...