Monthly
Stored cross-site scripting in OCO-Server 1.2.0 and earlier lets a crafted agent hostname execute JavaScript inside an administrator's authenticated session when the admin clicks one of the default VNC, RDP, SSH or Ping buttons on the computer details page. Reaching the sink requires three conditions to line up: the non-default 'agent-self-registration-enabled' setting must be turned on, the attacker must hold the shared 'agent-registration-key' used by all enrolled agents, and an administrator must then open the malicious 'ghost' computer's details page and activate a command button (PR:N with UI:R per the assessed vector, so no account is needed but admin interaction is). No CISA KEV entry, no confirmed public exploit code and no EPSS signal are associated with this issue at time of analysis - the GitHub advisory does include a step-by-step reproduction of the escaping bypass, making the flaw straightforward to verify, and the decision label places it in 'this_week' rather than an emergency tier.
Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.
Cross-site scripting in Kirby CMS's Panel writer field (versions <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3) lets an authenticated user inject a JavaScript-scheme URL into the link or email marks that executes in their own browser session when clicked before the content is saved. In Kirby's default configuration this is limited to self-XSS requiring social engineering, but Panel plugins that embed the <k-writer> component without sanitizing HTML before storage can be escalated to stored XSS affecting other users. There is no public exploit and it is not in CISA KEV; the vendor rates it high severity for affected sites.
Stored cross-site scripting in Django admin's URLField rendering allows a malicious URL value (e.g., using a `javascript:` scheme) to be displayed as a clickable link on changelist views and read-only admin fields without scheme validation. Any application that accepts URLField input via public-facing forms and exposes those records in the Django admin is affected, covering Django 5.2 through the 6.1 release candidate. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; patches were released August 4, 2026 as Django 5.2.17 and 6.0.8.
Stored cross-site scripting in earmark (the Elixir Markdown-to-HTML library by pragdave) allows any attacker who can submit markdown content to inject arbitrary JavaScript that executes in the browsers of users who view the rendered output. The root cause is a code path in `_make_att1/2` (`lib/earmark/transform.ex`) that splices HTML attribute values verbatim without encoding double-quote characters, enabling a crafted link URL or title to break out of the `href` attribute and inject additional HTML event handlers. Critically, no patched version will be released - the library has been officially retired from Hex - making migration to a maintained alternative the only complete fix. No public exploit identified at time of analysis, though the CVE description itself contains a working proof-of-concept payload.
Stored cross-site scripting in OpenClaw's session HTML export feature allows unsafe javascript: and data: URI schemes to survive into generated output files. All OpenClaw versions before 2026.5.12 are affected; exploitation requires a trusted operator to open an exported session HTML file and actively click a crafted link, at which point arbitrary JavaScript executes in their browser context. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the CVSS 4.0 score of 2.1 reflects the narrow attack prerequisites and limited subsequent-system impact.
Reflected XSS in Concrete CMS 9.5.0 and below allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of an authenticated admin or report viewer who clicks a crafted URL targeting the legacy form reports dashboard. The vulnerable component, Concrete\Core\Legacy\Pagination, raw-interpolates a user-controlled URL value directly into an HTML href attribute, enabling attribute injection per CWE-83. With a CVSS 4.0 score of 6.0 and high confidentiality impact (VC:H) on the vulnerable system, successful exploitation can lead to session token theft; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected XSS in Nuxt's `navigateTo()` function allows remote attackers to inject and execute arbitrary JavaScript in the application's origin during server-side rendering. Applications passing user-controlled input to `navigateTo(url, { external: true })` - the common post-login `?next=` or `?redirect=` redirect pattern - are affected across nuxt versions 3.4.3-3.21.5 and 4.0.0-alpha.1-4.4.5. A full proof-of-concept is published in the GitHub Security Advisory GHSA-fx6j-w5w5-h468; no public exploit identified at time of analysis beyond that PoC, and this CVE does not appear in CISA KEV.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
Saleor is an e-commerce platform. [CVSS 4.8 MEDIUM]
Stored cross-site scripting in OCO-Server 1.2.0 and earlier lets a crafted agent hostname execute JavaScript inside an administrator's authenticated session when the admin clicks one of the default VNC, RDP, SSH or Ping buttons on the computer details page. Reaching the sink requires three conditions to line up: the non-default 'agent-self-registration-enabled' setting must be turned on, the attacker must hold the shared 'agent-registration-key' used by all enrolled agents, and an administrator must then open the malicious 'ghost' computer's details page and activate a command button (PR:N with UI:R per the assessed vector, so no account is needed but admin interaction is). No CISA KEV entry, no confirmed public exploit code and no EPSS signal are associated with this issue at time of analysis - the GitHub advisory does include a step-by-step reproduction of the escaping bypass, making the flaw straightforward to verify, and the decision label places it in 'this_week' rather than an emergency tier.
Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.
Cross-site scripting in Kirby CMS's Panel writer field (versions <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3) lets an authenticated user inject a JavaScript-scheme URL into the link or email marks that executes in their own browser session when clicked before the content is saved. In Kirby's default configuration this is limited to self-XSS requiring social engineering, but Panel plugins that embed the <k-writer> component without sanitizing HTML before storage can be escalated to stored XSS affecting other users. There is no public exploit and it is not in CISA KEV; the vendor rates it high severity for affected sites.
Stored cross-site scripting in Django admin's URLField rendering allows a malicious URL value (e.g., using a `javascript:` scheme) to be displayed as a clickable link on changelist views and read-only admin fields without scheme validation. Any application that accepts URLField input via public-facing forms and exposes those records in the Django admin is affected, covering Django 5.2 through the 6.1 release candidate. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; patches were released August 4, 2026 as Django 5.2.17 and 6.0.8.
Stored cross-site scripting in earmark (the Elixir Markdown-to-HTML library by pragdave) allows any attacker who can submit markdown content to inject arbitrary JavaScript that executes in the browsers of users who view the rendered output. The root cause is a code path in `_make_att1/2` (`lib/earmark/transform.ex`) that splices HTML attribute values verbatim without encoding double-quote characters, enabling a crafted link URL or title to break out of the `href` attribute and inject additional HTML event handlers. Critically, no patched version will be released - the library has been officially retired from Hex - making migration to a maintained alternative the only complete fix. No public exploit identified at time of analysis, though the CVE description itself contains a working proof-of-concept payload.
Stored cross-site scripting in OpenClaw's session HTML export feature allows unsafe javascript: and data: URI schemes to survive into generated output files. All OpenClaw versions before 2026.5.12 are affected; exploitation requires a trusted operator to open an exported session HTML file and actively click a crafted link, at which point arbitrary JavaScript executes in their browser context. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the CVSS 4.0 score of 2.1 reflects the narrow attack prerequisites and limited subsequent-system impact.
Reflected XSS in Concrete CMS 9.5.0 and below allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of an authenticated admin or report viewer who clicks a crafted URL targeting the legacy form reports dashboard. The vulnerable component, Concrete\Core\Legacy\Pagination, raw-interpolates a user-controlled URL value directly into an HTML href attribute, enabling attribute injection per CWE-83. With a CVSS 4.0 score of 6.0 and high confidentiality impact (VC:H) on the vulnerable system, successful exploitation can lead to session token theft; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected XSS in Nuxt's `navigateTo()` function allows remote attackers to inject and execute arbitrary JavaScript in the application's origin during server-side rendering. Applications passing user-controlled input to `navigateTo(url, { external: true })` - the common post-login `?next=` or `?redirect=` redirect pattern - are affected across nuxt versions 3.4.3-3.21.5 and 4.0.0-alpha.1-4.4.5. A full proof-of-concept is published in the GitHub Security Advisory GHSA-fx6j-w5w5-h468; no public exploit identified at time of analysis beyond that PoC, and this CVE does not appear in CISA KEV.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
Saleor is an e-commerce platform. [CVSS 4.8 MEDIUM]