CVE-2026-111034

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post...

CVE-2026-111034

The Countdown, Coming Soon, Maintenance – Countdown & Clock WordPress plugin (versions up to and including 3.0.8 ) is vulnerable to a non-public post title disclosure via the select2Ajax AJAX action. The plugin fails to verify if a user is authorized to browse content before returning post titles...

CVE-2026-128040

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator...

CVE-2026-128040

The OpenMage magento-lts platform contains a stored cross-site scripting (XSS) vulnerability in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 . The flaw exists because admin pages render Dataflow profile link variables , tax rate titles , OAuth consumer names , and PayPal certifica...

CVE-2026-100381

CVE-2026-100381: DOM XSS in Flickr collection and set titles Reporter: Marco Paciaroni BomboBombone. UploadWizard inserted Flickr collection and set titles through an API that interpreted strings as HTML. External title metadata could therefore become executable markup in the wiki page. Affected...

CVE-2026-124691

In Progress Kendo UI for jQuery Gantt , a Cross-Site Scripting (XSS) vulnerability exists in the task editor's Parent dropdown . The component renders task titles as HTML, allowing an attacker who can influence a task title to execute attacker-controlled markup as JavaScript when a user interacts...

EUVD-2026-124539

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful...

CVE-2026-124691 Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - Line 369 .$thread-getTitle.''; 3. There are more! Root Cause: Forum thread titles are stored without proper sanitization Thread titles are displayed without HTML escaping in multiple locations No...

CVE-2025-59848

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59847

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

EUVD-2025-211310

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2026-102530

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome...

CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome...

CVE-2026-108546

A flaw was found in Spotweb. An unauthenticated remote attacker can achieve arbitrary command execution on the underlying server. This issue occurs because spot titles are not properly sanitized before being passed into system execution functions within the runcommand handler. When a user downloa...

CVE-2026-116086

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

EUVD-2026-114680

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

CVE-2026-116086 Konflux-ci: jq filter injection in github workflow issue management

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

CVE-2026-116086

A flaw in konflux-ci allows an attacker with permission to trigger automated workflow runs to cause information disclosure . The vulnerability exists because workflow scripts incorporate user-provided issue titles into data queries without adequate sanitization, enabling the injection of maliciou...

CVE-2026-116086 Konflux-ci: jq filter injection in github workflow issue management

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...