1870 matches found
CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...
GO-2024-2682 vulnerabilities
Vulnerabilities for packages: caddy, k3s, q, caddy-fips, cloudflared...
GO-2025-4017 vulnerabilities
Vulnerabilities for packages: ipfs-cluster, kargo, k3s, kubernetes-dns-node-cache, caddy, kubo, q, traefik, spegel, frp, dkron, kyverno-policy-reporter-ui, k8sgateway...
GO-2024-2682 vulnerabilities
Vulnerabilities for packages: k3s, caddy, cloudflared, q...
GO-2025-4233 vulnerabilities
Vulnerabilities for packages: ipfs-cluster, kargo, k3s, kubernetes-dns-node-cache, caddy, kubo, q, traefik, spegel, frp, dkron, buf, seaweedfs, k8sgateway...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-firehose, metrics-server, pgpool2exporter, terragrunt, kots, harbor-scanner-trivy, kyverno-policy-reporter-kyverno-plugin, aws-nuke, docker-machine-driver-linode, nri-haproxy, traefik, sigstore-scaffolding, opa-envoy, temporal-ui-server,...
CVE-2026-73295
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...
Malicious code in picasso-plugin-q (npm)
npm/picasso-plugin-q is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...
MAL-2026-11978 Malicious code in picasso-plugin-q (npm)
npm/picasso-plugin-q is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...
MINI-GHPC-VPFC-Q4HC
Bulletin has no description...
CVE-2026-14310
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...
Out-of-bounds Read
Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
MINI-Q428-9V23-PX25
Bulletin has no description...
FFC-DH Peer Validation Uses Attacker-Supplied q
...
MINI-V2GC-VH98-733Q
Bulletin has no description...
CVE-2026-6793
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7...
EUVD-2026-45977
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7...
py-mkdocs-material -- DOM XSS vulnerability
Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction...
CVE-2026-13244
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0...