2026

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote at

Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI sp

Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker

Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com

Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker w

Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatica

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfigu

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with t

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Informa

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert med

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defens

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalize

Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execut

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbit

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP)

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized

Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c

A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerabilit

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-f

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 all

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execut

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Desig

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attacke

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org whe

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated use

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run en

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged action

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an auth

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG s

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the dat

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users wi

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authoriz