CVE-2026-114531

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Swiper Formatter

CVE-2026-114529

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Csv Field

CVE-2026-114525

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Abc

CVE-2026-114526

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Black Hole

CVE-2026-114528

Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Zero Point

CVE-2026-114527

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ui Icons

CVE-2026-108514

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-108515

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-113429

Gitea stored XSS through legacy Actions artifact Content-Encoding

Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-72428

bpf: Fix stack slot index in nospec checks

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-61804

myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mytinywms

Products

Mytinywms

CVE-2026-119761

Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axigen

Products

Axigen Mail Server

CVE-2026-119680

Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Manageengine

Products

Sharepoint Manager Plus

CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Perl

Products

Webdyne

CVE-2026-118575

Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Signature Pad Widget

CVE-2026-118549

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Artificial Intelligence

CVE-2026-115452

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tassos.gr

Products

Advanced Custom Fields Extension For Joomla Smile Pack Extension For Joomla

CVE-2026-114538

Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Bootstrap

CVE-2026-117645

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1. attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag. This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phoenixframework

Products

Phoenix Html

CVE-2026-118564

PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Payumoney For Drupal Commerce