n8n Node.js Package < 1.123.9 / 2.x < 2.2.1 Stored XSS (CVE-2026-25054)

The version of the n8n Node.js Package installed on the remote host is prior to 1.123.9, or 2.x prior to 2.2.1. It is, therefore, affected by a stored cross-site scripting vulnerability: - A cross-site scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface,...

CVE-2026-2337

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-1571

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

CVE-2026-2337

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-2337

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-2337 Refleccted XSS on Plunet BusinessManager

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-2337 Refleccted XSS on Plunet BusinessManager

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-2337

CVE-2026-2337 : A vulnerability in Plunet Plunet BusinessManager (affected version: 10.15.1) allows session hijacking and data theft with unauthorized actions on behalf of the user. The connected documents specify the issue and affected product; no root-cause details, impact scope beyond confiden...

CVE-2026-1571

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

CVE-2026-1571 Reflected XSS Vulnerability on TP-Link Archer C60

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

TP-Link Archer C60 安全漏洞

The TP-Link Archer C60 is a wireless router produced by TP-Link Corporation. The TP-Link Archer C60 v3 has a security vulnerability. This vulnerability arises from the reflection of user inputs into the HTML output without proper encoding. This could allow for the execution of arbitrary JavaScrip...

CVE-2026-2337: Improper Neutralization of Input During Web Page Generation

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

CVE-2026-1571: Improper Neutralization of Input During Web Page Generation

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

Plunet BusinessManager 安全漏洞

Plunet BusinessManager is a business management system developed by the German company Plunet. The version 10.15.1 of Plunet BusinessManager contains a security vulnerability. This vulnerability stems from allowing session hijacking and data theft, potentially enabling unauthorized operations und...

PT-2026-7583

A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1...

SourceCodester Prison Management System 授权问题漏洞

The SourceCodester Prison Management System is an open-source prison management system developed by SourceCodester. Version 1.0 of the SourceCodester Prison Management System has vulnerabilities related to authorization issues. These vulnerabilities stem from session fixation, which may lead to...

CVE-2026-23796

Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this...

EUVD-2026-5552

Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this...

CVE-2026-1953

Nukegraphic CMS v3.1.2 contains a stored cross-site scripting XSS vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the database and rendering it across multiple CMS...

CVE-2026-1953 Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2

Nukegraphic CMS v3.1.2 contains a stored cross-site scripting XSS vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the database and rendering it across multiple CMS...