Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network
#severity:high
共收录 5396 条相关情报。
← 返回所有主题Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to...
CVE-2026-115975
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delet
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114178
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114697
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytic
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-112844
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114179
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114694
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Ma
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-112869
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link...
CVE-2026-112207
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site be
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined...
CVE-2026-113673
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor...
CVE-2026-115807
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root...
CVE-2026-115929
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root cer
The app/process-api-response-headers action accepts fake Craft API response headers from any...
CVE-2026-115935
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel
Craft CMS allows any authenticated control panel user to submit an element-search condition whose...
CVE-2026-115938
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is ev
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never...
CVE-2026-115937
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong
virtualenv: Xonsh activation literals depend on the script decoding codec
CVE-2026-113718
## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must in
virtualenv: Bash prompt values can change meaning under older compatibility modes
CVE-2026-113723
## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must inf
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109461
### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attack
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
CVE-2026-109869
### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than fiv
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-113872
### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js proces