Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
CVE-2026-75510
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox
#cwe-79
共收录 5376 条相关情报。
← 返回所有主题A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used fo...
CVE-2026-79315
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request U
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a Ja...
CVE-2026-95682
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org orga
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExpor...
CVE-2026-95665
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. Th
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the ...
CVE-2026-95396
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unk
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
CVE-2026-95682
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org orga
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was...
CVE-2026-95661
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes v
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from th...
CVE-2026-95659
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. T
MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95665
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. Th
MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
CVE-2026-95661
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes v
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
CVE-2026-95659
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. T
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due...
CVE-2026-93836
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty'
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and...
CVE-2026-93778
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (import
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and includin...
CVE-2026-1645
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all ...
CVE-2026-16778
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textare...
CVE-2026-94504
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy su
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow una...
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submis
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (...
CVE-2026-89412
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to ...
CVE-2026-93655
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' param
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not veri...
CVE-2026-88788
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputti