共收录 6044 条相关情报。
← 返回所有主题CVE-2026-42556
CVE-2026-42556 是 Postiz（一款AI社交媒体调度工具）中的一个存储型跨站脚本（XSS）漏洞。影响版本为 2.21.6 至 2.21.7（不含）。任何能够创建帖子的认证用户，在保存帖子时可以篡改自己的保存请求，在帖子内容中
CVE-2026-42451
Grimmory 是一个自托管的数字图书馆软件，用于管理 EPUB 电子书。在其 2.3.1 之前的版本中，浏览器内置的 EPUB 阅读器存在存储型跨站脚本（XSS）漏洞。攻击者可以通过制作特制的 EPUB 文件，在其中嵌入任意 JavaS
CVE-2026-42224
ipl/web is a set of common web components for php projects. Prior to version 0.13.1, the vulnerability allows an attacke
CVE-2026-44549
### Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the
CVE-2026-44831
### Impact Users with component view access could be impacted by an unescaped `notes` column. ### Patches This was pat
CVE-2026-44568
## Vulnerability Details **CWE-79**: Cross-site Scripting (XSS) The `AccountPending.svelte` component renders the admi
CVE-2026-42192
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (X
CVE-2026-44737
### Summary _A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the
CVE-2026-44588
## Summary The tooltip mouseover handler in `app/src/block/popover.ts` reads `aria-label` via `getAttribute` and passes
CVE-2026-44721
> [!IMPORTANT] > Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XS
CVE-2026-42794
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows
CVE-2026-42794
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows
CVE-2026-41886
locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK regi
CVE-2026-41683
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno
CVE-2026-41591
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/ru
CVE-2026-41576
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication req
CVE-2026-41575
In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting (XSS) vulnerability was ident
CVE-2026-41524
Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor ric
CVE-2026-7650
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id'
CVE-2026-7475
The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sky-custom-scripts` custom pos