CVE-2025-22131-PoC

CVE-2025-22131-PoC CVE-2025-22131 の PoC PhpSpreadsheet は純粋な PHP で書かれたライブラリであり、Excel や LibreOffice Calc などのさまざまなスプレッドシートファイル形式を読み書きするための一連のクラスを提供します。 phpspreadsheet のバージョン =2.2.0, =2.0.0, =3.0.0, sheetIndex === null $sheets = $this-spreadsheet-getAllSheets; else $sheets =...

CVE-2020-6418

CVE-2020-6418 CVE 2020-6418は、Google ChromeのV8における型混乱に関する脆弱性です。影響を受けるバージョンは80.0.3987.122より前です。この脆弱性は、リモートの攻撃者が細工されたHTMLページを介してターゲットデバイスのシェルにアクセスすることで達成されます。 環境要件 1. バージョン80.0.3987.122より前のGoogle Chrome。 root@kitploit: Note : The Google chrome browser should run with no sandbox for the exploit to be...

EUVD-2026-84953

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

Linux Distros Unpatched Vulnerability : CVE-2026-93981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an...

Linux Distros Unpatched Vulnerability : CVE-2026-92018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3,...

Linux Distros Unpatched Vulnerability : CVE-2026-92028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3,...

ALSA-2026:70640 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Linux Distros Unpatched Vulnerability : CVE-2026-92022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3,...

ALSA-2026:70641 Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...

CVE-2026-18131

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-18131 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2021-41074

CVE-2021-41074 Qloapps HotelCommerce 1.5.1 における CSRF HotelCommerce 1.5.1 には CSRF が存在します。これにより、誰でも管理者メールを変更できる可能性があります。 攻撃者が管理者に悪意を持って作成された HTML 文書をクリックさせると、管理者ユーザーのメールを変更される可能性があります。...

CVE-2026-77912

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2023-2859

CVE-2023-2859: TeamPass 3.0.9 の管理者に影響するfolderNameへの保存型HTMLインジェクション - M Nadeem Qazi こんにちは、 nilsteampassnet/teampass アプリケーションにおいて、FolderNameフィールドに保存型HTMLインジェクションが発生する重大な脆弱性を発見しました。悪意のあるHTMLコードをFolderNameフィールドに挿入することで、攻撃者はフォルダ名を変更することができます。 脆弱性の詳細 脆弱性タイプ: 保存型HTMLインジェクション CVE: CVE-2023-2859...

CVE-2026-93385

A flaw was found in Google Chrome. A remote attacker could exploit an information leak vulnerability in the Paint component by enticing a user to visit a specially crafted HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912

A stored cross-site scripting (XSS) vulnerability exists in GitHub Enterprise Server within the Markdown rendering pipeline . The flaw occurs because the pipeline rewrote quote characters in already-sanitized HTML without performing subsequent re-sanitization, allowing an authenticated attacker t...