Monthly
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. No public exploit code or confirmed in-the-wild exploitation has been identified, and the flaw is fixed in Home Assistant 2026.7.0.
Stored cross-site scripting in GoCD's Compare Pipeline page affects versions 18.3.0 through 25.x and allows an attacker holding commit access to a tracked material to inject URI or HTML special characters into a commit comment that GoCD later renders as an unescaped tracking-tool link. Successful exploitation within a victim's browser session can expose a privileged user's session or permit changes performed with that victim's credentials and privileges, though the CVSS 4.0 vector (AC:H/AT:P/PR:L/UI:P) and the layered prerequisites make this a non-trivial, non-drive-by issue. The flaw is fixed in GoCD 26.1.0, and no public exploit has been identified at time of analysis.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Cross-site scripting escalating to remote code execution in SiYuan (open-source personal knowledge management) before 3.7.1 lets an attacker embed a crafted asset link whose path contains a double quote, breaking out of an image src attribute in Asset.render to inject an event handler. Because SiYuan runs in an Electron renderer with OS-level capabilities, the injected JavaScript can execute arbitrary operating-system commands on the victim's machine once the malicious asset is opened. No public exploit identified at time of analysis, and it is not listed in CISA KEV; user interaction is required to trigger the flaw.
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript that executes in another backend user's browser when they open the PDF editor. Affected is the open-source Pretix event-ticketing platform on versions prior to the 2026.5.2 release; the malicious HTML embedded in a layout specification runs because the PDF editor page is one of the few backend pages that lacks a strong Content-Security-Policy. There is no public exploit identified at time of analysis, but the vendor has confirmed and patched the issue.
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authenticated user with annotation-guide create/edit privileges to inject malicious JavaScript into a task's annotation guide, which executes in any victim's browser that opens it. Executed script runs with the victim's CVAT session privileges, enabling arbitrary API requests on their behalf. No public exploit identified at time of analysis; EPSS is low (0.05%) and SSVC reports no observed exploitation.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Cross-site scripting (XSS) in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers, leading to session hijacking, credential theft, and malicious actions performed under victim's identity. The CVSS score of 8.8 (High) reflects the broad impact scope (confidentiality, integrity, availability all rated High), though user interaction is required. TR-CERT disclosure indicates awareness within Turkish government cybersecurity circles, but no CISA KEV listing or public exploit code identified at time of analysis, suggesting limited active exploitation outside potential targeted campaigns.
Cross-site scripting in OpenBao's OIDC/JWT authentication method allows theft of Web UI session tokens when roles are configured with callback_mode=direct. Attackers exploit the unsanitized error_description parameter on failed authentication pages to inject malicious scripts that execute in victims' browsers, granting access to authentication tokens. The vulnerability affects OpenBao installations prior to v2.5.2 and has no public exploit identified at time of analysis, though the technical implementation details are publicly documented in the vendor advisory.
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. No public exploit code or confirmed in-the-wild exploitation has been identified, and the flaw is fixed in Home Assistant 2026.7.0.
Stored cross-site scripting in GoCD's Compare Pipeline page affects versions 18.3.0 through 25.x and allows an attacker holding commit access to a tracked material to inject URI or HTML special characters into a commit comment that GoCD later renders as an unescaped tracking-tool link. Successful exploitation within a victim's browser session can expose a privileged user's session or permit changes performed with that victim's credentials and privileges, though the CVSS 4.0 vector (AC:H/AT:P/PR:L/UI:P) and the layered prerequisites make this a non-trivial, non-drive-by issue. The flaw is fixed in GoCD 26.1.0, and no public exploit has been identified at time of analysis.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Cross-site scripting escalating to remote code execution in SiYuan (open-source personal knowledge management) before 3.7.1 lets an attacker embed a crafted asset link whose path contains a double quote, breaking out of an image src attribute in Asset.render to inject an event handler. Because SiYuan runs in an Electron renderer with OS-level capabilities, the injected JavaScript can execute arbitrary operating-system commands on the victim's machine once the malicious asset is opened. No public exploit identified at time of analysis, and it is not listed in CISA KEV; user interaction is required to trigger the flaw.
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript that executes in another backend user's browser when they open the PDF editor. Affected is the open-source Pretix event-ticketing platform on versions prior to the 2026.5.2 release; the malicious HTML embedded in a layout specification runs because the PDF editor page is one of the few backend pages that lacks a strong Content-Security-Policy. There is no public exploit identified at time of analysis, but the vendor has confirmed and patched the issue.
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authenticated user with annotation-guide create/edit privileges to inject malicious JavaScript into a task's annotation guide, which executes in any victim's browser that opens it. Executed script runs with the victim's CVAT session privileges, enabling arbitrary API requests on their behalf. No public exploit identified at time of analysis; EPSS is low (0.05%) and SSVC reports no observed exploitation.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Cross-site scripting (XSS) in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers, leading to session hijacking, credential theft, and malicious actions performed under victim's identity. The CVSS score of 8.8 (High) reflects the broad impact scope (confidentiality, integrity, availability all rated High), though user interaction is required. TR-CERT disclosure indicates awareness within Turkish government cybersecurity circles, but no CISA KEV listing or public exploit code identified at time of analysis, suggesting limited active exploitation outside potential targeted campaigns.
Cross-site scripting in OpenBao's OIDC/JWT authentication method allows theft of Web UI session tokens when roles are configured with callback_mode=direct. Attackers exploit the unsanitized error_description parameter on failed authentication pages to inject malicious scripts that execute in victims' browsers, granting access to authentication tokens. The vulnerability affects OpenBao installations prior to v2.5.2 and has no public exploit identified at time of analysis, though the technical implementation details are publicly documented in the vendor advisory.