CVE-2026-41591

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a ,...

CVE-2026-41591: Improper Neutralization of Input During Web Page Generation

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a , , etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in mar...

CVE-2025-46295

CVE-2025-46295 is a Critical vulnerability affecting Apache Commons Text versions prior to 1.10.0. The flaw exists in the text-substitution API, where interpolation features can be abused if applications process untrusted input. This can lead to Remote Code Execution (RCE) as certain interpolator...

CVE-2016-10823

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation SEC-89...