CVE-2026-74902

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-75838

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-75773

karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Karakeep-app

Products

Karakeep

CVE-2026-39991

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Notes Station

CVE-2026-110899

WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kevin Stover Wordpress-extensions

Products

Ninja Forms Ninja Forms

CVE-2026-37980

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-112249

grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grandnode

Products

Grandnode2

CVE-2026-77114

Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Dan Rossiter Wordpress-extensions

Products

Document Gallery Document Gallery

CVE-2026-96563

Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress-extensions

Products

Motors - Car Dealer\, Classifieds \& Listing Motors

CVE-2026-114570

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-114219

NewType Infortech｜NT OneAPP - Hard-coded Credentials

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Newtype Infortech

Products

Nt Oneapp

CVE-2026-87942

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Safedelete

CVE-2026-87939

Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Feed Block

CVE-2026-84919

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Photoswipe - Responsive Javascript Modal Image Gallery

CVE-2026-96362

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96368

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96359

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96358

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96361

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96360

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform