CVE-2026-123094
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service
CVSS
5.4
Média
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 5 de nov. de 2026 · Última mod.: 5 de nov. de 2026 · CWE-79
Ainda não há histórico EPSS suficiente.
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
- github.comhttps://github.com/huginn/huginn
- github.comhttps://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88
- github.comhttps://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b
- github.comhttps://github.com/huginn/huginn/releases/tag/v2026.11.05
- github.comhttps://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww
- hackmd.iohttps://hackmd.io/@leediay/SJtUoLFTfx
- www.vulncheck.comhttps://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-76580——
——0Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS).
This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.4hCVE-2026-1039358.1 ALT—
——0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.4hCVE-2026-1154526.7 MÉD—
——0Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.4hCVE-2026-1079038.3 ALT—
——0Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.04hCVE-2026-1056078.3 ALT—
——0Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.04hCVE-2026-755995.4 MÉD—
——0HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.7h