Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses WebSphere Application Server Liberty, which is vulnerable to cross-site scripting (CVE-2025-12635)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is vulnerable to cross-site scripting. This issue has been addressed in this release. Vulnerability...

Cybozu Garoon vulnerable to cross-site scripting

Overview Scheduler in Cybozu Garoon provided by Cybozu, Inc contains the following vulnerability: Cross-Site Scripting CWE-79 - CVE-2026-57279 CyCDB-4148 Cybozu, Inc reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc coordinated under t...

CVE-2026-18682: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-66296: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-18243: Improper Neutralization of Input During Web Page Generation

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting XSS, which may allow unauthenticated HTTP requests to view print job previews...

CVE-2026-52520

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

PT-2026-67428

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting XSS, which may allow unauthenticated HTTP requests to view print job previews...

EUVD-2026-52404

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38446

A stored cross-site scripting XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-52520

Emlog CMS versions

PT-2026-67506

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.9 Description Authenticated attackers can perform a stored cross-site scripting attack by injecting arbitrary HTML or JavaScript into the certificate description field. This occurs via the trust certificate API,...

EUVD-2026-52484

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

📄 OpenClaw Dashboard Cross Site Scripting

OpenClaw Dashboard suffers from a persistent cross site scripting vulnerability via the lastMessage Session Field. Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft openclaw-dashboard Title: OpenClaw Dashboard Stored XSS via lastMessage Session Field...

EUVD-2026-52403

A stored cross-site scripting XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding...

PT-2026-67535

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag names parameter of the GET /api/save content admin endpoint,...

PT-2026-67465

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost thread entry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-52520

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

TencentOS Server 4: redis (TSSA-2026:0773)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0773 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-69149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, a...