Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.
Improper Encoding or Escaping of Output vulnerability in Apache Syncope.
Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
CVE-2026-54694 is a critical improper input validation vulnerability in the NationalSecurityAgency's skills-service (SkillTree platform) prior to version 4.4.2. It involves unfiltered HTML input in user registration fields that leads to cross-site scripting (XSS) attacks when administrators view quiz runs. There are three escalating exploitation paths: basic XSS, remote script loading allowing arbitrary admin actions, and full cross-site request forgery (CSRF) token theft enabling API abuse. The vulnerability is patched in version 4.4.2.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of phishing attacks.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of phishing attacks.
CVE-2026-69821 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions involving improper encoding or escaping of output in Active Directory Certificate Services (AD CS). This flaw allows an authorized attacker to elevate privileges locally. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has issued official fixes for affected versions.
CVE-2026-82756 is an improper encoding or escaping of output vulnerability in ash-project's ash_authentication_oauth2_server. It allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header by manipulating tenant data used in the header construction. This affects versions from 0.1.3 up to but not including 0.3.1. The vulnerability can cause clients to follow attacker-controlled authorization server URLs within the authentication challenge. The CVSS 4.0 score is 6.3, indicating medium severity.
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
CVE-2026-82681 is an improper encoding or escaping of output vulnerability in ash-project's ash_admin component. It allows an attacker controlling a record's string primary key to manipulate row-action URLs by injecting crafted query parameters. This occurs because the primary key and other parameters are interpolated into URLs without URL-encoding, enabling parameter injection that can alter the intended action of links. The vulnerability affects versions from 0.3.0-rc.0 before 1.3.1 of ash_admin.
MariaDB Connector/R2DBC versions prior to 1.4.1 improperly handle mid-session changes to the character_set_client encoding when it is changed from UTF-8 to another character set. This causes a mismatch between client and server character encoding, leading to silent data corruption and potential bypass of byte-wise quoting or escaping. The issue is fixed in version 1.4.1 by restricting accepted character sets to utf8, utf8mb3, or utf8mb4 after initialization, closing the connection otherwise.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a SQL injection vulnerability when using certain client character sets (big5, gbk, sjis, cp932, or gb18030). This occurs due to improper escaping of attacker-controlled Buffer parameters client-side, allowing an attacker to inject arbitrary SQL. The default utf8mb4 character set and prepared-statement execution paths are not affected. The vulnerability can lead to exposure or modification of data accessible to the database account. Fixed versions are available.
CVE-2026-81522 is a high-severity vulnerability in the MongoDB C++ Driver version 3.0.0. It involves improper encoding or escaping of output related to namespace identifiers constructed from untrusted input. This flaw can allow an attacker to manipulate namespace identifiers with special characters, potentially causing operations to target unintended data. The impact includes limited unauthorized read and write access to data belonging to other logical tenants within the affected application.
NVIDIA OpenShell for Linux has a vulnerability in its inference proxy involving improper encoding or escaping of output. This flaw could allow an attacker with local privileges to cause information disclosure and data tampering. The vulnerability has a medium severity rating with a CVSS score of 5.2. No affected versions or patches are explicitly stated in the available data.
CVE-2026-55618 is a vulnerability in the GOVCERT-LU eml_parser Python module prior to version 3.0.2. The issue involves improper encoding or escaping of output in the clean_found_uri function, which validates URL strings before unescaping certain HTML entities. This causes valid encoded URLs and their hostnames to be rejected and omitted from extracted URL and domain lists. As a result, email security gateways and SOC pipelines relying on these lists may fail to detect malicious URLs, allowing them to bypass inspection. The vulnerability is fixed in eml_parser version 3.0.2.
Multiple security vulnerabilities affect Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.22.11. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), denial of service issues in Go language packages, privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.
CVE-2026-61824 is a high-severity cross-site scripting (XSS) vulnerability in kepano defuddle versions prior to 0.19.1. The vulnerability arises because defuddle interpolates certain page-derived values into HTML without proper context-aware escaping and bypasses the main pipeline's DOM-based sanitization. This allows attacker-controlled content to inject malicious event-handler attributes or JavaScript URLs, which execute when the extracted HTML is rendered. The issue affects specific extractor modules and is fixed in version 0.19.1.
CVE-2026-61398 is a critical vulnerability in Apache CloudStack affecting versions from 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It involves improper encoding or escaping of output in the UI during the Instance Reset Password functionality. This flaw can lead to high impact on confidentiality and integrity. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-61399 is an improper encoding or escaping of output vulnerability in the Apache CloudStack UI related to the Lock User functionality. It affects versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.8.
CVE-2025-36254 is a high-severity vulnerability in IBM System Storage DS8A00 and DS8900F series. It involves improper encoding or escaping of DSCLI command output, which could allow an attacker to bypass security authentication. This flaw may lead to unauthorized access to sensitive information or cause a denial of service. The affected versions include IBM DS8A00 from 10.1.3.0 through 10.11.35.0 and IBM DS8900F from 89.40.83.0 through 89.44.25.0.