63482 matches found
CVE-2026-106345
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106119
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-104073
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
CVE-2026-104073
NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...
CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
EUVD-2026-93660
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
EUVD-2026-93651
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106345
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106345
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106345
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106345
Google Chrome versions prior to 155.0.8059.39 are vulnerable to a use of released resource flaw within the Session component . This vulnerability allows a remote attacker, who has already compromised the renderer process , to spoof UI elements by serving a crafted HTML page. The impact is categor...
EUVD-2026-93779
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...
CVE-2026-106119
The LangChain framework is vulnerable to a query injection flaw in the MongoDBChatMessageHistory component prior to version 1.3.1 . The root cause is a failure to enforce the documented string type for untrusted structured session identifiers at runtime, which allows these identifiers to be inter...
CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-100725
A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be...
CVE-2015-9251
CVE-2015-9251 [email protected] CVE-2015-9251（3.0.0 未満の jQuery）向けの PoC。 CVE-2015-9251 - PoC エクスプロイト このリポジトリには、jQuery ライブラリの脆弱性 CVE-2015-9251 に対する Proof of Concept（PoC） が含まれています。この脆弱性は、jQuery が 3.0.0 より前のバージョンで callback パラメータへのコード注入を許可していたため、サニタイズされていない JSONP...