Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server and is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary The security issue described in CVE-2026-14974, CVE-2026-14515 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixe...

CVE-2026-19988

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...

CVE-2026-19988 Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...

CVE-2026-19988 Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...

CVE-2026-19988

The CVE-2026-19988 affects the Alaev SEO Tools Extension for Chrome (up to version 1.0.10). The vulnerability targets Popup UI, specifically the addDiv function in src/popup.html, enabling basic cross-site scripting via manipulation. Exploitation is possible remotely and the exploit is public. No...

PT-2026-73299

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

A Cross Site Scripting (XSS) vulnerability exists in Squirro Cognitive Search versions prior to 3.14.2 . This flaw allows a remote attacker to execute arbitrary code by interacting with the Email Notification , Create Evaluation Sets , and HTML Editor functions. While the description identifies t...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-67925

A Cross Site Scripting (XSS) vulnerability exists in JeecgBoot v.3.9.2 . A remote attacker can exploit this flaw via the /airag/chat/upload endpoint to execute arbitrary code. While the impact is described as code execution, the vulnerability is categorized as XSS. Specific information regarding ...

PT-2026-77036

Name of the Vulnerable Software and Affected Versions SSL Zen versions prior to 4.7.44 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-75078: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-67925: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-74234: Undefined Security Weakness

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-50771: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-19998: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

CVE-2026-19995: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...