CVE-2026-112039

diem-project diem Administrative Console actions.class.php append cross site scripting

A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Diem-project

Products

Diem

CVE-2026-112031

Chamilo LMS Ticket TicketManager.php addProject cross site scripting

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Chamilo

Products

Lms

CVE-2026-111987

AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automatic1111

Products

Stable-diffusion-webui

CVE-2026-111984

AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automatic1111

Products

Stable-diffusion-webui

CVE-2026-74921

Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Document Gallery

CVE-2026-111942

hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting

A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hrisikeshpal

Products

Blood Bank Management System

CVE-2026-111874

OpenCATS Career Portal CareersUI.php processLogin excessive authentication

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opencats

Products

Opencats

CVE-2026-110897

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109131

Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose documentation contains a link using a script-executing URL scheme can therefore cause script to run in the same origin as the Hub UI when another authenticated user views and activates that link in the collection documentation page. This is a stored cross-site scripting issue in shipped Platform UI code (present in the AAP 2.6 and 2.7 release branches).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-108485

WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111407

WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress-extensions

Products

Tutor Lms Tutor Lms

CVE-2026-109744

Other issue in the DOM: File component

Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-106150

Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-94167

WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Extendthemes Wordpress-extensions

Products

Kubio Ai Page Builder Kubio Ai Page Builder

CVE-2026-100185

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpwax

Products

Directorist Directorist: Ai-powered Business Directory, Listings & Classified Ads

CVE-2026-22896

Stored XSS via Interface Name in Network & Virtual Switch App

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Network & Virtual Switch

CVE-2026-63430

ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly implement annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes encoding, so the sanitizer validates a descendant under one namespace interpretation while the browser reparses the output under another. An attacker can use that namespace transition and an allowed raw-text HTML element to execute JavaScript when a user renders the sanitized output. The required tags are not enabled by default, so applications that do not explicitly allow them are not affected. This issue is fixed in versions 3.3.2, 4.0.2, and 4.1.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rust-ammonia

Products

Ammonia

CVE-2026-105033

EnergizeLab AI Station Default Root Credentials with SSH Enabled

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Ai Station Firmware (rk3562)

CVE-2026-89069

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Moveit Transfer

CVE-2026-109734

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox