Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected ...

CVE-2026-103346

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex

历史摘要 · 未重新核验 · NVD

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This...

CVE-2026-105705

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function o

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function...

CVE-2026-105708

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the fi

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

CVE-2026-39760

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

历史摘要 · 未重新核验 · GitHub Advisory

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripti...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin

历史摘要 · 未重新核验 · NVD

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

CVE-2026-39760

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

历史摘要 · 未重新核验 · NVD

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Ex...

CVE-2026-105708

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the fi

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation ...

CVE-2026-105705

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function o

历史摘要 · 未重新核验 · NVD

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes ...

CVE-2026-105784

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.1

历史摘要 · 未重新核验 · NVD

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

## Environment - dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 2

历史摘要 · 未重新核验 · GitHub Advisory

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attrib...

CVE-2026-105694

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. O...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as book...

CVE-2026-105651

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post...

CVE-2026-105650

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled websi

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitizati...

CVE-2026-105649

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded wit

历史摘要 · 未重新核验 · NVD

In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.

CVE-2026-95166

In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payloa

历史摘要 · 未重新核验 · NVD

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.

CVE-2026-95165

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Admi...

CVE-2026-105644

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were store

历史摘要 · 未重新核验 · NVD

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any...

CVE-2026-105643

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could by

历史摘要 · 未重新核验 · NVD