SUSE CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-70431: Improper Control of Generation of Code

Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-9195: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

CVE-2026-15452: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-68207

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3 Description Extension tab and scripting APIs were not scoped to the extension's own session. This...

PT-2026-68221

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

PT-2026-68971

Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...

PT-2026-68266

Name of the Vulnerable Software and Affected Versions Jenkins Multijob Plugin versions 669.v9d96a d9c71b 0 and earlier Description The software provides Groovy scripting features that fail to integrate with the Script Security Plugin. This allows users with Item/Create or Item/Configure permissio...

CVE-2026-70602: Improper Access Control

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting

A proof of concept exploit for a cross site scripting vulnerability in ICS-Park Smart Park Management System version 2.0. An authenticated user can upload arbitrary HTML files because the upload whitelist permits .html and .htm extensions, resulting in stored cross site scripting when another use...

Stored XSS vulnerability in summary_report

summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...

Stored XSS vulnerability in qualys-cs

qualys-cs 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce...

Arbitrary code execution vulnerability in jenkins-multijob-plugin

jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin. This vulnerability allows attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 XSS (7281641)

The version of IBM WebSphere Application Server running on the remote host is affected by a XSS vulnerability as referenced in the 7281641 advisory. - IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization...

CVE-2026-71285: Improper Neutralization of Input During Web Page Generation

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

GHSA-XPP7-93X6-V29M XSS in Ghost's ActivityPub client

Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. Vulnerable Versions This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. Patches...

CVE-2026-15920

A flaw was found in Django. The django.contrib.admin.utils.displayforfield function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote...