Tag
Alertus Desktop Alert: Unauthenticated Remote HTML Injection (CVE-2026-38903)
1 CVEA public proof-of-concept (PoC) exists for CVE-2026-38903, an unauthenticated remote HTML injection vulnerability in Alertus Desktop Alert v5.4.98.0. The vulnerability stems from a certificate validation bypass that allows attackers to render arbitrary HTML and execute JavaScript within a Trident WebBrowser control.
CVE-2026-41611: Visual Studio Code XSS Vulnerability
2 rules 4 TTPs 1 CVECVE-2026-41611 is a cross-site scripting (XSS) vulnerability in Visual Studio Code that allows an attacker to execute code locally due to improper neutralization of script-related HTML tags.
JupyterLab Command Execution via Crafted HTML Content
2 rules 1 TTPJupyterLab's HTML sanitizer allows execution of arbitrary commands via specially crafted HTML content in notebooks or Markdown files due to improper handling of `data-commandlinker-command` and `data-commandlinker-args` attributes.
GitLab Improper HTML Sanitization Vulnerability (CVE-2026-2995)
2 rules 2 TTPsCVE-2026-2995 is a vulnerability in GitLab EE versions 15.4 to 18.10.1 where an authenticated user can add email addresses to other user accounts due to improper HTML sanitization, potentially leading to account takeover or information disclosure.
MantisBT Stored XSS Vulnerability via Tag Timeline Display
2 rules 1 TTPA stored HTML injection vulnerability (CVE-2026-33548) exists in MantisBT version 2.28.0, allowing attackers to inject HTML and execute arbitrary JavaScript by manipulating tag names displayed in the timeline due to improper escaping.