CVE-2026-88743

Bacularis (a web-based Bacula backup frontend) versions 4.7.0 through 6.5.0 are affected by a stored cross-site scripting (XSS) vulnerability in director tags . The CNA-assigned CVSS v3.1 score is 6.1 (Medium) , with a network attack vector, low complexity, no privileges required, user interactio...

CVE-2026-88743

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

CVE-2026-51133

CVE-2026-51133 is a Cross-Site Scripting (XSS) vulnerability in za-internet GmbH C-MOR Video Surveillance versions 6.0104 and below . A remote attacker can execute arbitrary client-side code by crafting malicious URLs targeting the size parameter in the ptzpreset.pml component and the anyparam pa...

CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance = V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component...

EUVD-2026-78942

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

RHEL 10 : grafana (RHSA-2026:67517)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67517 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: crypto/x509:...

CVE-2026-90835

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2026-90835

A cross-site scripting (XSS) vulnerability exists in michaelliao itranswarp (up to version 2.19), specifically in the function Markdown.toHtml within Markdown.java under the Page Content Rendering component. The flaw allows a remote attacker to inject scripts via crafted page content. The exploit...

CVE-2026-90835 michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...

CVE-2026-91146

Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-16186

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-15634

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

CVE-2026-15396

CVE-2026-15396 affects IBM WebSphere Application Server (traditional 8.5 and 9.0) and IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8). The root cause is improper parsing of the HTTP transfer-encoding request header (CWE-444), enabling HTTP request smuggling . An unauthentica...

CVE-2026-15634

CVE-2026-15634 is an HTTP request smuggling vulnerability (CWE-444) in IBM WebSphere Application Server 9.0, 8.5, and Liberty (17.0.0.3–26.0.0.8), caused by improper parsing of the HTTP transfer-encoding request header . A remote, unauthenticated attacker can send a specially crafted header to po...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...

CVE-2026-90795

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103

CVE-2026-4103 is a stored cross-site scripting (XSS) vulnerability in WSO2 API Manager's Publisher Portal and Developer Portal , caused by insufficient HTML sanitization that allows untrusted user input to be rendered without proper encoding or neutralization. When affected API documents are view...