CVE-2026-106707: Improper Neutralization of Input During Web Page Generation

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...

CVE-2026-74920: Improper Neutralization of Input During Web Page Generation

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visito...

CVE-2026-111168: Improper Neutralization of Input During Web Page Generation

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/uuid serves it inlin...

CVE-2026-106706

XXL-JOB versions through 3.5.0-SNAPSHOT are vulnerable to stored cross-site scripting (XSS) within the GLUE code editor . The vulnerability exists because the JobCodeController.save() method stores the user-supplied glueSource parameter without proper output encoding. Subsequently, the FreeMarker...

CVE-2026-106706: Improper Neutralization of Input During Web Page Generation

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...

CVE-2026-58390: Improper Neutralization of Input During Web Page Generation

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

PT-2026-115017

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9...

CVE-2026-106148: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

PT-2026-114779

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-109131: Improper Neutralization of Input During Web Page Generation

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

CVE-2026-55184: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...

CVE-2026-58391: Improper Neutralization of Input During Web Page Generation

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...

PT-2026-114901

Name of the Vulnerable Software and Affected Versions bannersky BSK PDF Manager versions prior to 3.8.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target serv...

PT-2026-114771

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-58392: Improper Neutralization of Input During Web Page Generation

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-55872: Improper Neutralization of Input During Web Page Generation

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-106153: Improper Neutralization of Input During Web Page Generation

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106706

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...

CVE-2026-110890: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6...

CVE-2026-106161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...