unstructured: Stored XSS via unescaped HTML generation
CVE-2026-104250
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc
#cwe-79
共收录 5345 条相关情报。
← 返回所有主题Cronicle: Stored XSS in admin Activity Log via account full_name field
CVE-2026-55562
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revo...
CVE-2026-49264
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's Rev
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a craf...
CVE-2026-102982
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.1
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
CVE-2026-49264
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's Rev
Plane: XSS in work item comments
CVE-2026-102982
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output ...
CVE-2026-53711
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts fe
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an anim...
CVE-2026-102342
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that
MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
CVE-2026-53711
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts fe
ammonia allows stored XSS through unsanitized SVG animate and set attributes
CVE-2026-102342
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme v...
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backen...
CVE-2026-78557
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an atta...
CVE-2026-63357
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before re
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could ...
CVE-2026-63356
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an a...
CVE-2026-63355
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in se
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an att...
CVE-2026-63354
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before r
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social eng...
CVE-2026-63353
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to ...
CVE-2026-63352
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering