NPM: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

NPM: Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html vulnerability discovered by ? in WordPress Npm sanitize-html versions 2.17.3...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +1893 more potentially affected by CVE-2026-44990 via sanitize-html (>=2.1.0, <=2.17.3)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =0.2.0-a0, =1.0.0, =0.0.1, =0.5.2 and more Source cves: CVE-2026-44990 Source advisory: SNYK:JS-SANITIZEHTML-16697325...

CVE-2026-6332 Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it...

WS-2012-0023

XSS injection vulnerability was found in loofah before 0.4.6. Loofah Gem for Ruby contains a flaw that allows a remote cross-site scripting XSS attack. This flaw exists because the Loofah::HTML::Document\text function passes properly sanitized user-supplied input to the Loofah::XssFoliate and...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendertocul function. An attacker can execute arbitrary JavaScript in the context of the rendered page by injecting malicious input into heading text, which is then used unescaped as an anchor ID and labe...

WS-2021-0039

Cross-Site Scripting XSS vulnerability was found in @angular/core before 11.1.1. HTML doesn't specify any way to escape comment end text inside the comment...

BIT-PARSE-2026-43930 Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0, a race condition in the MFA SMS one-time password OTP login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid...

CVE-2026-3694

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the btbbbutton shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WS-2019-0293

Vant before 2.1.8 is vulnerable to Cross-Site Scripting. The text value of the Picker component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser...

CVE-2026-3694 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the btbbbutton shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2026-3694

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the btbbbutton shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WS-2019-0259

In vant, versions prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the Picker component column isn't sanitized. this may lead attackers to execute arbitrary JavaScript in the victim's browser...

WS-2019-0235

swagger-ui versions before 2.2.1 are vulnerable to XSS when it fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html it may allow attackers to execut...

WS-2016-0060

In Ckeditor-dev, versions prior to 4.5.11, the plugin "link.js" was vulnerable to an XSS vulnerability via link's "Display Text" field...

PT-2026-40882

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt bb button shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2026-41154

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.1 Description An authenticated server-side request forgery SSRF exists in the rich-text widget import flow. An authenticated user with permissions to submit or edit rich-text widget content can force the...

PT-2026-41160

Name of the Vulnerable Software and Affected Versions Marten versions prior to 8.36.1 Description Marten's full-text search APIs interpolate the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation. This creates a SQL injection sink in any code...

Rich Text Edit Control Privilege Escalation

The vulnerability of the Rich Text Edit Control text editor in Windows operating systems is related to the repeated release of memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Rich Text Edit Control Privilege Escalation

The vulnerability of the Rich Text Edit Control text editor in the Windows operating system is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to increase their privileges...

EUVD-2026-29922

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...