262288 matches found
GHSA-Q742-QVGC-GC2F TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Impact Stored XSS vulnerability via unsanitized data-mce- attributes data-mce-href, data-mce-src, data-mce-style. Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. Patches Patched by stripping unsafe data-mce- attributes during...
CVE-2026-7471
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation...
CVE-2026-7142
A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function addorupdatescript of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has...
CVE-2026-30269
Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/username. The role field is accepted by the update model without a manageusers permission check for self-updates, enabling privileg...
CVE-2026-30616
Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation result...
CVE-2026-49318
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module WCM traffic during its boot window as a...
CVE-2026-5090
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The htmlfilter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in would not be properly escaped. An attacke...
CVE-2026-9938 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-9940 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-3PX4-28QC-4F47 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-4JM4-GH3X-CQ86 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-9930 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-RPM7-PHH8-26F7 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-XF9G-PXHX-JG8C vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-9GGG-9FQ9-QXVG vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-F56C-QCQF-CQ94 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-W739-54JW-WCMF vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-9917 vulnerabilities
Vulnerabilities for packages: chromium...