75787 matches found
PT-2026-133252
Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious clie...
CVE-2026-113409: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to…
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
PT-2026-132282
Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...
UncleCode Crawl4AI code injection vulnerability
UncleCode Crawl4AI versions prior to 0.9.0 through 0.9.5 contain a code injection vulnerability. This flaw stems from improper handling of the cssselector and waitfor fields by the Docker API server. Attackers can inject quotes or js: conditions to bypass the jscode block, allowing authenticated...
RHEL 8 : thunderbird (RHSA-2026:90913)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90913 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect bounda...
jsprime
Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Context.JSONP and Context.JSONPBlob methods in context.go. An attacker can make a victim’s browser execute arbitrary JavaScript in the site’s origin by sending a request with a crafted callback value tha...
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...
EUVD-2026-112511
AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...
CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface
AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...
EUVD-2026-110462
Seroval: Code injection through a typed array's own constructor property...
CVE-2026-118668
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...
GHSA-4HM6-W6QQ-W73V LangGraph JavaScript custom authentication may permit cross-user Store access
Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...
LangGraph JavaScript custom authentication may permit cross-user Store access
Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...
CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...
EUVD-2026-112487
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...
CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...