CVE-2026-114570

A flaw was found in WordPress. Insufficient escaping of user display names in the Quick Edit feature allows an authenticated user with contributor-level privileges to conduct stored Cross-Site Scripting XSS attacks. By submitting malicious scripts, an attacker can cause them to execute within the...

EUVD-2026-108279

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not...

CVE-2026-115519

The KNIME Business Hub (versions prior to 1.19.0 ) is vulnerable to session compromise because sensitive cookies lack the 'Secure' and 'HttpOnly' attributes. This flaw allows an unauthenticated remote attacker to hijack user sessions if secondary vulnerabilities, such as a cross-site scripting (X...

CVE-2026-115519 Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not...

CVE-2016-6271

CVE-2016-6271 CVE-2016-6271 impacts libbzrtp, which is a ZRTP library developped by Belledonne Communications. This library is embedded in end-user applications, for example linphone, which is available as an Android app on Play store. Current version 3.2.7 embeds a version of libbzrtp shall not ...

BIT-GHOST-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

BIT-GHOST-2026-105644 Ghost: Stored XSS via SVG Files in Content Imports

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...

PT-2026-111356

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-9191

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

EUVD-2026-97504

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

PT-2026-110650

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.x Description Insufficient isolation of user-supplied code executed through certain REST and XDBC evaluation paths may expose HTTP request, response,...

BIT-GHOST-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

Cross-Site Scripting (XSS)

Ghost is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to imported SVG images being stored without sanitization, which allows an attacker to convince an Administrator to import a crafted file and host malicious scripts on the site's domain, potentially compromising staff users'...

Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

GHSA-69QC-F5M6-889C Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

GHSA-HQQ2-XQR2-FMX2 Ghost : Stored XSS via SVG Files in Content Imports

Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...

EUVD-2026-92633

Ghost : Stored XSS via SVG Files in Content Imports...

GHSA-8575-CR6V-7JH4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versio...

EUVD-2026-92756

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization...

GHSA-V3XR-G6P2-FVGV Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...