33342 matches found
PT-2026-84999
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...
CVE-2026-33630: Double Free
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...
PT-2026-85307
Name of the Vulnerable Software and Affected Versions Microsoft Discovery Studio affected versions not specified Description Improper neutralization of special elements in data query logic allows an unauthorized attacker to disclose protected information over a network. Recommendations At the...
CVE-2026-85227: Improper Neutralization of Input During Web Page Generation
MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...
PT-2026-85058
MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...
CVE-2026-82417
creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:31+00:00| published-proof-of-concept| https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g 2026-09-28 18:39:22+00:00| seen| https://gist.github.com/tomasantunes/b27c1462edf01f28a31f453280d86577 2026-10-18 21:17:42+00:00|...
Cross-site Scripting (XSS)
Appium is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized reflection of user-controlled query parameters, POST fields, and HTTP headers into HTML, which allows an attacker to execute arbitrary JavaScript on the server origin...
CVE-2026-78584
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62600
Orval: Import-time RCE via query-parameter default - zod module-level template literal...
GHSA-P4CG-3328-RVFG Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
EUVD-2026-70063
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
EUVD-2026-68765
Livewire DOM-based cross-site scripting during client-side state handling...
CVE-2026-82562
A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
UBUNTU-CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...