These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-48821 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Shaarli's Thumbnail Synchronizer feature. An administrator running the thumbnail update process is affected, as malicious bookmark titles are returned via an AJAX response and inserted into the DOM using innerHTML without proper sanitization. The vulnerability allows attackers to inject malicious scripts, potentially leading to sess [truncated]
CVE-2026-48823 is a stored Cross-Site Scripting (XSS) vulnerability in Shaarli's tag filtering functionality. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark. The malicious payload is stored and later executed when users interact with the 'Filter by tag' search feature on the homepage. User-supplied input in the tags field is not properly sanitized or out [truncated]
CVE-2026-48822 is a stored Cross-Site Scripting (XSS) vulnerability in Shaarli, a personal bookmarking service. The vulnerability affects versions 0.16.1 and prior and is caused by a flaw in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link, allowing for potential XSS attacks. The vulnerabilit [truncated]