EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

EUVD-2026-67400

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081: Server-Side Request Forgery (SSRF)

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-39071

The Spiffy Plugin WordPress plugin, specifically versions 5.0.8 and lower , is vulnerable to Stored Cross-Site Scripting (XSS) in the Event Title field. An authenticated attacker with the lowest privileged role (contributor ) can exploit this flaw to redirect users to a malicious site or gain con...

PT-2026-83077

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-39071

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

PT-2026-82867

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-39071: Improper Neutralization of Input During Web Page Generation

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

PT-2026-83173

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

CVE-2026-39071

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67900

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

CVE-2026-78071: Improper Neutralization of Input During Web Page Generation

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67163

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

CVE-2026-48996 Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

CVE-2026-81814

Flowintel is vulnerable to stored XSS in its calendar view. Calendar event titles are derived from case titles and rendered via innerHTML , allowing a user who can create or modify a case title to inject HTML or script-capable content that executes in the browser of another user viewing the calen...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...