CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

CVE-2024-23998

Another Redis Desktop Manager PoC A Proof-Of-Concept for CVE-2024-23998 vulnerability. 1. Vunerability Overview: Vulnerability Subject: Local Code Excution via XSS Vulnerability Version: =\ 2. Font...

CVE-2026-128076 Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)

Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /nuxtisland path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the...

CVE-2026-64670

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...

CVE-2026-118368

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

CVE-2026-118368

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

CVE-2026-118368

Akaunting version 3.3.0 is vulnerable to a stored cross-site scripting (XSS) flaw within the XLSX item-import workflow. An authenticated Manager can exploit this by importing an item containing malicious HTML in its name. When another authenticated user selects this item while creating a document...

CVE-2026-118368 Akaunting 3.3.0 - Stored XSS through imported item names

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

CVE-2026-118368 Akaunting 3.3.0 - Stored XSS through imported item names

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

EUVD-2026-123152

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

PT-2026-144972

Name of the Vulnerable Software and Affected Versions Waline versions prior to 3.15.3 Description A stored Cross-Site Scripting XSS issue exists in the @waline/client component. The system renders the comment editor's live preview using the marked library without a sanitizer in utils/markdown.ts,...

CVE-2026-118368: Akaunting: Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

CVE-2026-64670: walinejs waline: Waline is a comment system with backend support

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...

CVE-2026-120443 GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

EUVD-2026-115203

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

CVE-2026-61728

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customeruser, can submit stored markup through POST...

CVE-2026-61728 SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customeruser, can submit stored markup through POST...

CVE-2026-61728 SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customeruser, can submit stored markup through POST...

CVE-2026-61728

SOCFortress CoPilot is vulnerable to Stored Cross-Site Scripting (XSS) due to unsanitized HTML rendering in the v-html directive within AlertComment.vue. Attackers can submit malicious markup via POST /api/incidents/db_operations/alert/comment, which executes in the context of other users viewing...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...