Skip to content
Threat Feed
Subscribe

Tag

Html-Injection

4 briefs RSS
high advisory

CVE-2026-41611: Visual Studio Code XSS Vulnerability

CVE-2026-41611 is a cross-site scripting (XSS) vulnerability in Visual Studio Code that allows an attacker to execute code locally due to improper neutralization of script-related HTML tags.

Visual Studio Code cve xss visual-studio-code html-injection
2r 4t 1c
high advisory

JupyterLab Command Execution via Crafted HTML Content

JupyterLab's HTML sanitizer allows execution of arbitrary commands via specially crafted HTML content in notebooks or Markdown files due to improper handling of `data-commandlinker-command` and `data-commandlinker-args` attributes.

jupyterlab +1 command-execution html-injection
2r 1t
medium advisory

GitLab Improper HTML Sanitization Vulnerability (CVE-2026-2995)

CVE-2026-2995 is a vulnerability in GitLab EE versions 15.4 to 18.10.1 where an authenticated user can add email addresses to other user accounts due to improper HTML sanitization, potentially leading to account takeover or information disclosure.

gitlab html-injection cve-2026-2995
2r 2t
high advisory

MantisBT Stored XSS Vulnerability via Tag Timeline Display

A stored HTML injection vulnerability (CVE-2026-33548) exists in MantisBT version 2.28.0, allowing attackers to inject HTML and execute arbitrary JavaScript by manipulating tag names displayed in the timeline due to improper escaping.

MantisBT xss html-injection cve-2026-33548 webserver
2r 1t