The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitizat…

▾ SunlitEPSS 0.42%via NVD

CVE-2026-44990Critical· 9.3PoC

3mo ago

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-contro…

▾ Abyssalapostrophecms · sanitize-htmlEPSS 0.69%via NVD

GHSA-6jq6-x4cx-qvcmMedium

3mo ago

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

▾ Sunlitgrumpydictator · grumpydictator/firefly-iiivia GHSA

CVE-2026-47344Low

3mo ago

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

▾ Sunlitfabric · fabricEPSS 0.27%via GHSA

CVE-2026-40986Medium· 4.8

3mo ago

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server cont…

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server cont…

▾ Sunlitbroadcom · spring_web_flowEPSS 0.25%via NVD

CVE-2026-41003High· 7.6

3mo ago

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 …

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 …

▾ Twilightvmware · spring_securityEPSS 0.25%via NVD

CVE-2026-0266Medium· 4.8

3mo ago

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-…

▾ Sunlitpaloaltonetworks · pan-osEPSS 0.14%via NVD

CVE-2026-48060High· 8.1PoC

3mo ago

Litestar has HTML Injection Through its CSRF Token

▾ Midnightlitestar · litestarEPSS 0.40%via GHSA

CVE-2026-53441Medium· 5.4

3mo ago

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a store…

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a store…

▾ Sunlitjenkins · jenkinsEPSS 0.34%via NVD

CVE-2026-45468Medium· 4.6

3mo ago

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

▾ SunlitMicrosoft · Microsoft SharePoint Enterprise Server 2016EPSS 0.58%via CVEORG

CVE-2026-45467Medium· 4.6

3mo ago

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

▾ SunlitMicrosoft · Microsoft SharePoint Enterprise Server 2016EPSS 0.58%via CVEORG

CWE-79

Hugo: XSS via text/html content files

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

n8n: Stored XSS in Chat Trigger Node

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitizat…

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

TYPO3 HTML Sanitizer allows Cross-site Scripting

TYPO3 CMS has Cross-Site Scripting in Indexed Search

TYPO3 HTML Sanitizer allows Cross-site Scripting

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server cont…

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 …

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface

Litestar has HTML Injection Through its CSRF Token

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a store…

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability