https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T14:56:48.603917+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33742 CVE-2026-33742 — Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes 2026-10-22T14:56:48.604991+00:00

Affected: invoiceninja

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output.