A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performi...

CVE-2026-19988

根据 NVD 元数据，Chrome 浏览器中的 Alaev SEO Tools 扩展程序（版本 1.0.10 及更早版本）存在一个基本型跨站脚本（XSS）漏洞。该漏洞位于扩展的弹窗用户界面（Popup UI）组件中，具体涉及 src/pop

历史摘要 · 未重新核验 · NVD

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

CVE-2026-73238

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recomme

历史摘要 · 未重新核验 · NVD

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which...

CVE-2026-73237

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1.

历史摘要 · 未重新核验 · NVD

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTa

历史摘要 · 未重新核验 · NVD

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

CVE-2026-65841

A `` element placed directly inside an `` (or MathML) container was not removed by Jodit's clean-html sanitizer. The de

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in...

CVE-2026-34497

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issu...

CVE-2026-34497

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste

历史摘要 · 未重新核验 · NVD

Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting ...

CVE-2024-58353

Cal.com (repository calcom/cal.diy) in versions ). Booking question (form field) labels are rendered via React's dangero

历史摘要 · 未重新核验 · GitHub Advisory

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting...

CVE-2024-58355

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking

历史摘要 · 未重新核验 · GitHub Advisory

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and fram...

CVE-2026-32822

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dat

历史摘要 · 未重新核验 · NVD

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

CVE-2026-54570

### Summary The HTML specification requires that a MathML `` element with `encoding="text/html"` or `encoding="applicati

历史摘要 · 未重新核验 · GitHub Advisory

plone.restapi: Stored XSS by spoofing mime type

### Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whene

历史摘要 · 未重新核验 · GitHub Advisory

plone.app.textfield: Stored XSS by spoofing mime type

CVE-2026-54503

### Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whene

历史摘要 · 未重新核验 · GitHub Advisory

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before ren...

CVE-2026-54443

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssF

历史摘要 · 未重新核验 · NVD

Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE-2026-54443

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssF

历史摘要 · 未重新核验 · OSV.dev

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through...

CVE-2026-59838

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.

历史摘要 · 未重新核验 · NVD

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing vide...

CVE-2026-57167

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages em

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assi...

CVE-2026-59855

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts in

历史摘要 · 未重新核验 · NVD

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

CVE-2026-52774

### Summary YesWiki's Bazar widget handler reflects the `id` `GET` parameter into HTML attributes using `strip_tags()` o

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

CVE-2026-52773

### Summary YesWiki's archived-revision view reflects the `time` `GET` parameter into a hidden HTML input in `handlers/p

历史摘要 · 未重新核验 · GitHub Advisory