# CWE-116.

Every Advisory and CVE whose sources give the weakness CWE-116, newest first.

## Records, newest first (an older page)

- [Reflected XSS in authenticated agent context](https://agentprime.io/advisories/CVE-2026-48209.md)
  `CVE-2026-48209` · CVE record: OTRS AG OTRS and 1 more · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [pam_usb: Command injection via $TMUX environment variable leads to RCE as root](https://agentprime.io/advisories/CVE-2026-44713.md)
  `CVE-2026-44713` · CVE record: mcdope pam_usb · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection, CWE-116
- [CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters](https://agentprime.io/advisories/GHSA-7g26-2qgj-chfg.md)
  `GHSA-7g26-2qgj-chfg`, `CVE-2026-44587` · RubyGems `carrierwave`: affected `<2.2.7 || >=3.0.0.beta, <3.1.3`, fixed in `2.2.7`, `3.1.3` · CVSS 4.7 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-184, CWE-625
- [CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS](https://agentprime.io/advisories/GHSA-g2g4-47gv-p72v.md)
  `GHSA-g2g4-47gv-p72v`, `CVE-2026-26028` · npm `cryptpad`: affected `<=5.9.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [NousResearch hermes-agent Slack Agent/Mattermost Agent escape output](https://agentprime.io/advisories/CVE-2026-9354.md)
  `CVE-2026-9354` · CVE record: NousResearch hermes-agent · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, CWE-116
- [Twig: HTML-output filters in twig/\* extras incorrectly declared \`is_safe => \['all'\]\`](https://agentprime.io/advisories/GHSA-jv8m-2544-3pg3.md)
  `GHSA-jv8m-2544-3pg3`, `CVE-2026-46637`, `PKSA-7b1y-jwqf-x6v6`, `PKSA-fs5b-x5k4-1h39` · Packagist `twig/cssinliner-extra` and 1 more: affected `<3.26.0`, fixed in `3.26.0` · CVSS 5.1 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-116
- [Twig: The \`spaceless\` filter implicitly marks its output as safe](https://agentprime.io/advisories/GHSA-4j38-f5cw-54h7.md)
  `GHSA-4j38-f5cw-54h7`, `CVE-2026-46628`, `PKSA-sjvz-tbbr-vwth` · Packagist `twig/twig`: affected `<3.26.0`, fixed in `3.26.0` · CVSS 5.1 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-116
- [CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output](https://agentprime.io/advisories/CVE-2026-34246.md)
  `CVE-2026-34246` · CVE record: Ctrlpanel-gg panel · CVSS 4.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [go-git: Improper single-quote escaping in go-git SSH transport](https://agentprime.io/advisories/GHSA-m7cr-m3pv-hgrp.md)
  `GHSA-m7cr-m3pv-hgrp`, `CVE-2026-45570`, `GO-2026-5496` · Go `github.com/go-git/go-git` and 2 more: affected `<=4.7.0`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 19 May 2026 · Tags: CWE-116
- [HAX CMS: Stored XSS via '\<video-player>' component allows arbitrary JavaScript execution and token theft](https://agentprime.io/advisories/GHSA-2m6p-hm3w-6jm3.md)
  `GHSA-2m6p-hm3w-6jm3`, `CVE-2026-46496` · npm `@haxtheweb/haxcms-nodejs` and 1 more: affected `<26.0.0`, fixed in `26.0.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Apostrophe has stored XSS via javascript: URL in Image Widget Link](https://agentprime.io/advisories/GHSA-5f64-7vfc-rcx6.md)
  `GHSA-5f64-7vfc-rcx6`, `CVE-2026-45011` · npm `apostrophe`: affected `=4.29.0`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 14 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [SiYuan Bazaar marketplace renders unescaped package \`name\` and \`version\` metadata, allowing stored XSS and Electron code execution](https://agentprime.io/advisories/GHSA-27qc-m5gf-jv5r.md)
  `GHSA-27qc-m5gf-jv5r`, `CVE-2026-45375`, `GO-2026-5001` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<=0.0.0-20260421031503-96dfe0bea474`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Improper output encoding in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-28907.md)
  `CVE-2026-28907` · CVE record: Apple Safari and 4 more · CVSS 8.1 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-20, CWE-116
- [GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content](https://agentprime.io/advisories/GHSA-m5p4-gvpx-4mvr.md)
  `GHSA-m5p4-gvpx-4mvr`, `CVE-2026-44972`, `PYSEC-2026-2506` · PyPI `guarddog`: affected `>=2.6.0, <=2.9.0`, no fixed version yet · CVSS 5.0 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-116
- [Hono has CSS Declaration Injection via Style Object Values in JSX SSR](https://agentprime.io/advisories/GHSA-qp7p-654g-cw7p.md)
  `GHSA-qp7p-654g-cw7p`, `CVE-2026-44458` · npm `hono`: affected `<4.12.18`, fixed in `4.12.18` · CVSS 4.3 Medium · Not analysed yet · Published 9 May 2026 · Tags: Other injection, CWE-116
- [SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)](https://agentprime.io/advisories/GHSA-25rp-h46x-2hjm.md)
  `GHSA-25rp-h46x-2hjm`, `CVE-2026-44588`, `GO-2026-4993` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<=0.0.0-20260421031503-96dfe0bea474`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-1188
- [MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled \`websiteUrl\`](https://agentprime.io/advisories/GHSA-rqv2-m695-f8j4.md)
  `GHSA-rqv2-m695-f8j4`, `CVE-2026-44429`, `GO-2026-5637` · Go `github.com/modelcontextprotocol/registry`: affected `<1.7.7`, fixed in `1.7.7` · CVSS 5.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers](https://agentprime.io/advisories/GHSA-3v85-fqvh-7rxf.md)
  `GHSA-3v85-fqvh-7rxf`, `CVE-2026-79663`, `GO-2026-5100` · Go `github.com/lin-snow/Ech0`: affected `<1.4.8-0.20260503035519-fd320fe3e902`, fixed in `1.4.8-0.20260503035519-fd320fe3e902` · CVSS 4.8 Medium · Not analysed yet · Published 7 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering](https://agentprime.io/advisories/GHSA-9525-27vj-c8r8.md)
  `GHSA-9525-27vj-c8r8`, `CVE-2026-46367`, `PKSA-1zxw-krpv-74xh`, `PKSA-vm8f-6283-2vfw` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `>=4.1.1, <4.1.2`, fixed in `4.1.2` · CVSS 8.3 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers](https://agentprime.io/advisories/GHSA-8rq5-wwpp-fmj2.md)
  `GHSA-8rq5-wwpp-fmj2`, `CVE-2026-43939` · NuGet `YAFNET.Core`: affected `<3.2.12 || >=4.0.0-beta01, <4.0.5`, fixed in `3.2.12`, `4.0.5` · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected \`User-Agent\` Header](https://agentprime.io/advisories/GHSA-33gv-fc78-qgf5.md)
  `GHSA-33gv-fc78-qgf5`, `CVE-2026-43938` · NuGet `YAFNET.Core`: affected `<3.2.12 || >=4.0.0-beta01, <4.0.5`, fixed in `3.2.12`, `4.0.5` · CVSS 8.1 High · Not analysed yet · Published 5 May 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams](https://agentprime.io/advisories/GHSA-xhjh-pmcv-23jw.md)
  `GHSA-xhjh-pmcv-23jw`, `CVE-2026-42040` · npm `axios`: affected `<0.31.1 || >=1.0.0, <1.15.1`, fixed in `0.31.1`, `1.15.1` · CVSS 3.7 Low · Not analysed yet · Published 5 May 2026 · Tags: CWE-116, CWE-626
- [Apache Polaris has an Improper Input Validation Issue](https://agentprime.io/advisories/GHSA-vxgg-mqx2-3w59.md)
  `GHSA-vxgg-mqx2-3w59`, `CVE-2026-42810` · Maven `org.apache.polaris:polaris-core`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: CWE-20, CWE-116
- [AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component](https://agentprime.io/advisories/CVE-2026-41318.md)
  `CVE-2026-41318` · CVE record: Mintplex-Labs anything-llm · CVSS 5.4 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116
- [PRSD detection denial of service](https://agentprime.io/advisories/CVE-2026-33597.md)
  `CVE-2026-33597` · CVE record: PowerDNS DNSdist · CVSS 3.7 Low · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-116
- [mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API](https://agentprime.io/advisories/CVE-2026-40871.md)
  `CVE-2026-40871` · CVE record: mailcow mailcow-dockerized · CVSS 7.2 High · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection, CWE-20, CWE-116
- [FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization](https://agentprime.io/advisories/CVE-2026-40568.md)
  `CVE-2026-40568` · CVE record: freescout-help-desk freescout · CVSS 8.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables](https://agentprime.io/advisories/CVE-2026-40567.md)
  `CVE-2026-40567` · CVE record: freescout-help-desk freescout · CVSS 5.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-116
- [Improper output encoding in Zyxel WRE6505 v2 firmware](https://agentprime.io/advisories/CVE-2026-6058.md)
  `CVE-2026-6058` · CVE record: Zyxel WRE6505 v2 firmware · CVSS 4.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-116
- [pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders](https://agentprime.io/advisories/GHSA-jm8c-9f3j-4378.md)
  `GHSA-jm8c-9f3j-4378`, `CVE-2026-41426`, `PYSEC-2026-109` · PyPI `pretalx`: affected `<2026.1.0`, fixed in `2026.1.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [ChurchCRM: Stored XSS in UserEditor.php via Login Name Field](https://agentprime.io/advisories/CVE-2026-40593.md)
  `CVE-2026-40593` · CVE record: ChurchCRM CRM · CVSS 4.8 Medium · Not analysed yet · Published 18 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field](https://agentprime.io/advisories/CVE-2026-40483.md)
  `CVE-2026-40483` · CVE record: ChurchCRM CRM · CVSS 5.4 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Stirling-PDF: Reflected XSS through crafted filename in file upload functionality](https://agentprime.io/advisories/CVE-2026-33436.md)
  `CVE-2026-33436` · CVE record: Stirling-Tools Stirling-PDF · CVSS 3.1 Low · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering](https://agentprime.io/advisories/GHSA-4fxq-2x3x-6xqx.md)
  `GHSA-4fxq-2x3x-6xqx`, `CVE-2026-40302`, `GO-2026-5118` · Go `github.com/openziti/zrok` and 1 more: affected `<=1.1.11`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS](https://agentprime.io/advisories/GHSA-855c-r2vq-c292.md)
  `GHSA-855c-r2vq-c292`, `CVE-2026-35569` · npm `apostrophe`: affected `<4.29.0`, fixed in `4.29.0` · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-20136.md)
  `CVE-2026-20136` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 6.0 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-116
- [Improper output encoding in Schneider Electric PowerChute™ Serial Shutdown](https://agentprime.io/advisories/CVE-2026-2404.md)
  `CVE-2026-2404` · CVE record: Schneider Electric PowerChute™ Serial Shutdown · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-116
- [EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field](https://agentprime.io/advisories/CVE-2026-33657.md)
  `CVE-2026-33657` · CVE record: espocrm espocrm · CVSS 4.6 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix](https://agentprime.io/advisories/GHSA-3p24-9x7v-7789.md)
  `GHSA-3p24-9x7v-7789`, `CVE-2026-35582` · Maven `gov.nsa.emissary:emissary`: affected `<8.43.0`, fixed in `8.43.0` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Command injection, CWE-116
- [Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout](https://agentprime.io/advisories/GHSA-w35j-pv5h-q9q9.md)
  `GHSA-w35j-pv5h-q9q9`, `CVE-2026-34481` · Maven `org.apache.logging.log4j:log4j-layout-template-json`: affected `>=2.14.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-h383-gmxw-35v2.md)
  `GHSA-h383-gmxw-35v2`, `CVE-2026-34479` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.7, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta2`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-4f7c-pmjv-c25w.md)
  `GHSA-4f7c-pmjv-c25w`, `CVE-2026-40021` · NuGet `log4net`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-3pxv-7cmr-fjr4.md)
  `GHSA-3pxv-7cmr-fjr4`, `CVE-2026-34480` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.0-alpha1, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/CVE-2026-40023.md)
  `CVE-2026-40023` · CVE record: Apache Software Foundation Apache Log4cxx and 2 more · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve](https://agentprime.io/advisories/GHSA-rv64-5gf8-9qq8.md)
  `GHSA-rv64-5gf8-9qq8`, `BIT-tomcat-2026-34483`, `CVE-2026-34483` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.40, <9.0.116 || >=10.1.0-M1, <10.1.54 || >=11.0.0-M1, <11.0.21`, fixed in `9.0.116`, `10.1.54`, `11.0.21` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-116
- [ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection](https://agentprime.io/advisories/CVE-2026-35534.md)
  `CVE-2026-35534` · CVE record: ChurchCRM CRM · CVSS 7.6 High · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [lichess.org has an Unsanitized Stream Title Injection on /streamer](https://agentprime.io/advisories/CVE-2026-35208.md)
  `CVE-2026-35208` · CVE record: lichess-org lila · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [GLPI has an Unauthenticated Stored XSS via inventory](https://agentprime.io/advisories/CVE-2026-26027.md)
  `CVE-2026-26027` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Authentication bypass, CWE-116
- [GLPI has Stored XSS in Supplier 'Website' field](https://agentprime.io/advisories/CVE-2026-25932.md)
  `CVE-2026-25932` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenClaw has ACP CLI approval prompt ANSI escape sequence injection](https://agentprime.io/advisories/GHSA-4hmj-39m8-jwc7.md)
  `GHSA-4hmj-39m8-jwc7`, `CVE-2026-35651` · npm `openclaw`: affected `>=2026.2.13, <2026.3.28`, fixed in `2026.3.28` · CVSS 5.3 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: CWE-116, CWE-150
- [AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction](https://agentprime.io/advisories/GHSA-mvm6-f9r3-fgfx.md)
  `GHSA-mvm6-f9r3-fgfx` · NuGet `AWSSDK.CloudFront` and 1 more: affected `<3.7.510.7`, fixed in `3.7.510.7` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-116
- [AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities](https://agentprime.io/advisories/GHSA-443w-3rq3-5m5h.md)
  `GHSA-443w-3rq3-5m5h` · Maven `software.amazon.awssdk:cloudfront`: affected `>=2.18.33, <2.41.30`, fixed in `2.41.30` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-116
- [Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options](https://agentprime.io/advisories/GHSA-xjpj-3mr7-gcpf.md)
  `GHSA-xjpj-3mr7-gcpf`, `CVE-2026-33941` · npm `handlebars`: affected `>=4.0.0, <4.7.9`, fixed in `4.7.9` · CVSS 8.3 High · Not analysed yet · Published 27 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116
- [Loofah has improper detection of disallowed URIs via \`allowed_uri?\`](https://agentprime.io/advisories/GHSA-2j22-pr5w-6gq8.md)
  `GHSA-2j22-pr5w-6gq8` · RubyGems `loofah`: affected `>=2.25.0, <2.25.1`, fixed in `2.25.1` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenBao has Reflected XSS in its OIDC authentication error message](https://agentprime.io/advisories/GHSA-cpj3-3r2f-xj59.md)
  `GHSA-cpj3-3r2f-xj59`, `BIT-openbao-2026-33758`, `CVE-2026-33758`, `GO-2026-4862` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260325133417-6e2b2dd84f0e`, fixed in `0.0.0-20260325133417-6e2b2dd84f0e` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items](https://agentprime.io/advisories/GHSA-98wm-cxpw-847p.md)
  `GHSA-98wm-cxpw-847p`, `CVE-2026-33628`, `PKSA-txpv-wmxc-xy2c` · Packagist `invoiceninja/invoiceninja`: affected `<5.13.4`, fixed in `5.13.4` · CVSS 5.4 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-184
- [Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection](https://agentprime.io/advisories/CVE-2026-32986.md)
  `CVE-2026-32986` · CVE record: Textpattern Textpattern CMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [SuiteCRM has blind XSS in return_id parameter](https://agentprime.io/advisories/CVE-2026-29106.md)
  `CVE-2026-29106` · CVE record: SuiteCRM SuiteCRM · CVSS 5.9 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-159
- [FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})](https://agentprime.io/advisories/CVE-2026-32754.md)
  `CVE-2026-32754` · CVE record: freescout-help-desk freescout · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenEMR has arbitrary image file read via PDF generator](https://agentprime.io/advisories/CVE-2026-33301.md)
  `CVE-2026-33301` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-116

Newest: <https://agentprime.io/advisories/tag/cwe-116.md>
Older: <https://agentprime.io/advisories/tag/cwe-116.md?cursor=WyIyMDI2LTAzLTE5VDIwOjEwOjQzLjIwMjAwMFoiLCJDVkUtMjAyNi0zMzMwMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-116&cursor=WyIyMDI2LTA2LTAyVDE5OjA4OjE5LjkyMTAwMFoiLCJHSFNBLTI4amgtZzMyeC12OXY0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-116/?cursor=WyIyMDI2LTA2LTAyVDE5OjA4OjE5LjkyMTAwMFoiLCJHSFNBLTI4amgtZzMyeC12OXY0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.