PT-2026-51296

Name of the Vulnerable Software and Affected Versions IBM Engineering Workflow Management versions 7.0.3 through 7.0.3 Interim Fix 020 IBM Engineering Workflow Management versions 7.1 through 7.1 Interim Fix 007 Description An issue exists where an authenticated user can embed arbitrary JavaScrip...

PT-2026-51276

Name of the Vulnerable Software and Affected Versions ultimate-woocommerce-auction-pro versions prior to 2.4.6 Description The ultimate-woocommerce-auction-pro WordPress plugin fails to sanitize and escape a parameter before outputting it on the page. This leads to Reflected Cross-Site Scripting...

PT-2026-51278

Name of the Vulnerable Software and Affected Versions Transbank Webpay WordPress plugin versions prior to 1.14.0 Description The plugin fails to sanitize and escape logs before they are displayed. This allows unauthenticated users to execute Stored Cross-Site Scripting XSS attacks, which is a...

PT-2026-53740

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.22 Apache Tomcat versions 10.1.0-M1 through 10.1.55 Apache Tomcat versions 9.0.0.M1 through 9.0.118 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

PT-2026-51277

Name of the Vulnerable Software and Affected Versions ultimate-woocommerce-auction-pro versions prior to 2.4.6 Description The ultimate-woocommerce-auction-pro WordPress plugin fails to sanitize and escape a parameter before outputting it on the page. This leads to Reflected Cross-Site Scripting...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-1884)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1884 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1847)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1847 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an...

Important: runfinch-finch

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

Important: soci-snapshotter

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

Important: runfinch-finch

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

PT-2026-51324

Name of the Vulnerable Software and Affected Versions IBM Engineering Workflow Management versions 7.0.2 through 7.0.2 Interim Fix 035 IBM Engineering Workflow Management versions 7.0.3 through 7.0.3 Interim Fix 017 IBM Engineering Workflow Management versions 7.1 through 7.1 Interim Fix 004...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1885)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1885 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an...

CVE-2026-12811 kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The...

CVE-2026-12811

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The...

CVE-2026-12811 kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The...

CVE-2026-12811

The CVE affects kortix-ai suna prior to 0.8.39, specifically the Auth Endpoint’s frontend component at apps/frontend/src/app/auth/page.tsx. The vulnerability stems from router.push/replace handling of the returnURL argument, enabling cross-site scripting. Exploitation is possible remotely and the...

GHSA-F95G-VM94-46C3 Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4mgv-366x-qxvx. This link is maintained to preserve external references. Original Description Craft CMS 4.x = 4.0.0-RC1, = 5.0.0-RC1, 5.9.0-beta.1 contain multiple stored cross-site scripting vulnerabilities whe...

GHSA-9R7J-7JHG-4F4C Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g3hp-vvqf-8vw6. This link is maintained to preserve external references. Original Description Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page...

GHSA-5W9J-W5P8-R4P7 Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6j87-m5qx-9fqp. This link is maintained to preserve external references. Original Description Craft CMS contains a stored cross-site scripting XSS vulnerability in the editableTable.twig component when using the...

CVE-2026-56393

Craft CMS 4.x = 4.0.0-RC1, = 5.0.0-RC1, 5.9.0-beta.1 contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization e.g., via the checkbox.twig template, which used label|raw . An authenticated administrator with...