CVE-2026-68528

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS = v2.0 - XSS Almacenado a Escalada de Privilegios POC CVE-2025-26153 Resumen Este repositorio contiene una prueba de concepto que demuestra una vulnerabilidad de cross-site scripting XSS almacenado en Chamilo LMS que puede ser explotada para lograr escalada de privilegios desde un...

CVE-2026-82024

The LearnPress WordPress Plugin (before 4.4.6 ) contains a stored XSS vulnerability. Authenticated users with the Instructor role can inject arbitrary JavaScript by submitting unsanitized input into quiz question answer title fields , which is rendered through an unescaped HTML sink . The payload...

CVE-2026-55425

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

EUVD-2026-67856

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-81814

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

EUVD-2026-67014

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

Astra Linux – Vulnerability in Firefox

GNOME was leaking browser tab titles into system logs. This could potentially expose users’ browsing habits when they are using private tabs. This vulnerability affects Firefox versions earlier than 121...

Astra Linux – Vulnerability in Firefox

Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The combination of caching and suggestion techniques may have led to the title of a website visited during private browsing mode being stored on...

CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-75626

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

EUVD-2026-60577

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626

SpiderFoot fails to HTML-escape correlation titles built from external scan data (server banners, metadata), allowing stored XSS: attackers inject malicious HTML/event handlers that execute scripts in operators' browsers when the correlations view is opened, potentially stealing API keys. No patc...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

PT-2026-77175

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...