Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion

A directory traversal vulnerability in the JE Form Creator comjeformcr component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE -- the original researcher states that the...

EUVD-2026-63133

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all...

CVE-2026-76326

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all...

CVE-2026-76346

CVE-2026-76346 is a stored XSS in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) caused by Splunk Web failing to escape tooltip values in dashboard sparkline format options. A user with the "power" role can inject a malicious script that executes in the browser of another u...

CVE-2026-76326

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 have a stored XSS flaw: the dashboard table renderer fails to escape tooltip content, allowing a non-admin user to inject JavaScript that executes when another user hovers over a sparkline cell. Exploitation details are not provi...

CVE-2026-73156

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-73156

CVE-2026-73156 affects ct i-transmute: HTML-escaping is missing in ECharts Sunburst/Treemap tooltip formatters, allowing injected content via STIX/MISP-derived slice names. The fix adds formatter functions that call escapeHtml() on p.name, p.data.value, and p.value to prevent HTML/script executio...

CVE-2026-73156

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

EUVD-2026-55973

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

PT-2026-70082

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names, which may originate from STIX or MISP data—including...

MAL-2026-12489 Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

PT-2026-64409

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A stored cross-site scripting issue exists in the @milkdown/preset-commonmark and @milkdown/components packages. Attackers with document write access can execute arbitrary JavaScript in the browser...

CVE-2026-15647

Affected software: Brands for WooCommerce (WordPress plugin). Vulnerable component: br_brand_tooltip term meta; root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with custom-level access can store scripts via term meta, leading to stored XSS when pag...

CVE-2026-64795

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

EUVD-2026-47808

Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers...

CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

CVE-2026-36214

CVE-2026-36214 — osTicket Stored XSS affects osTicket versions 1.10–1.17.7 and 1.18.0–1.18.3 due to a vulnerable Bootstrap Tooltip (3.3.4) and insufficient HTML sanitization. The attack stores a malicious JS payload in a ticket attachment and executes it when an Agent/Admin views the ticket, enab...