1136862 matches found
CVE-2026-106707
The XXL-JOB framework, version
CVE-2026-106701
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...
WordPress Import and Export Users and Customers 2.4.5 Cross Site Scripting
WordPress Import and Export Users and Customers plugin versions through 2.4.5 contain an authenticated stored cross site scripting vulnerability through custom column user meta profile fields...
EUVD-2026-102256
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...
EUVD-2026-102257
XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...
EUVD-2026-102258
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...
CVE-2026-106701
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...
CVE-2026-106706
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...
CVE-2026-106706
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...
PT-2026-115275
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...
GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-92883)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...
CVE-2026-111284: Improper Neutralization of Input During Web Page Generation
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...
PT-2026-114782
Apply the DSA-2026-405 security update for Dell Wyse Management Suite to fix four XSS flaws, including critical bug CVE-2026-82158 CVSS 9.0. Dell WyseManagementSuite Cybersecurity Vulnerability XSS InfoSec https://t.co/PeIVNUn0pa...
CVE-2026-106157: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...
Critical: idm:DL1 security, bug fix, and enhancement update
AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...
CVE-2026-106707
XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...
PT-2026-114932
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute...
PT-2026-114899
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
VulnCheck KEV: CVE-2026-39781
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1...
VulnCheck KEV: CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...