https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 21:56:34 +0000 https://db.gcve.eu/vuln/cve-2026-75599 <p><strong>Affected:</strong> sysadminsmedia homebox</p> <p>HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim&#39;s HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.</p> <p><strong>Affected:</strong> sysadminsmedia homebox</p> <p>HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim&#39;s HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.</p> https://db.gcve.eu/vuln/cve-2026-75599