共收录 5955 条相关情报。
← 返回所有主题CVE-2026-43876
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php t
CVE-2026-45026
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vuln
CVE-2026-45025
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vuln
CVE-2026-42887
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulne
CVE-2026-42872
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) v
CVE-2026-42870
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw
CVE-2026-44657
Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can ex
CVE-2026-44655
Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access leve
CVE-2026-43979
## Summary `PDFService._markdown_to_html()` constructs an HTML document by interpolating user-controlled values — speci
CVE-2026-41897
Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Pag
CVE-2026-40607
Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_r
CVE-2026-40598
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject H
CVE-2026-40597
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-
CVE-2026-40596
Any authenticated user can inject arbitrary HTML via updating their account's font family. ### Impact Cross-site script
CVE-2026-39960
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacke
CVE-2026-34463
When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepen
CVE-2026-7308
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript t
CVE-2026-42857
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_ht
CVE-2026-41250
Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stor
CVE-2026-38569
HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fi