36 matches found
CVE-2026-56852 affecting package cri-tools for versions less than 1.32.0-7
CVE-2026-56852 affecting package cri-tools for versions less than 1.32.0-7. A patched version of the package is available...
EUVD-2026-44927
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator...
CVE-2026-59861
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...
CVE-2026-59862 Kiota: Code Generation Literal Injection in the Python Generator
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values.description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and...
CVE-2026-59862
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values.description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and...
PT-2026-60480
Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.0 Description The Ruby generator in Kiota fails to properly escape the character when embedding OpenAPI default fields, property names, and other schema-derived strings into Ruby double-quoted literals. This occurs...
CVE-2026-42502 affecting package cri-tools for versions less than 1.32.0-6
CVE-2026-42502 affecting package cri-tools for versions less than 1.32.0-6. A patched version of the package is available...
CVE-2026-27136 affecting package cri-tools for versions less than 1.32.0-6
CVE-2026-27136 affecting package cri-tools for versions less than 1.32.0-6. A patched version of the package is available...
CVE-2026-25680 affecting package cri-tools for versions less than 1.32.0-6
CVE-2026-25680 affecting package cri-tools for versions less than 1.32.0-6. A patched version of the package is available...
CVE-2026-39821 affecting package cri-tools for versions less than 1.32.0-6
CVE-2026-39821 affecting package cri-tools for versions less than 1.32.0-6. A patched version of the package is available...
CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-5
CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-5. A patched version of the package is available...
CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4
CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4. A patched version of the package is available...
CVE-2026-1866
The WordPress plugin Name Directory (vulnerable up to 1.32.0) is affected by a Stored XSS due to double HTML-entity encoding in its sanitization flow. The plugin decodes HTML entities before wp_kses and decodes output again, enabling unauthenticated attackers to inject scripts via the public subm...
CVE-2026-1866 Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling htmlentitydecode before wpkses, and then calling htmlentitydecode again on...
WordPress Name Directory plugin <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form vulnerability
Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form vulnerability discovered by duy.thai in WordPress Plugin Name Directory versions = 1.32.0...
WordPress plugin Name Directory 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...
AZL-76919 CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76916 CVE-2025-47911 affecting package cri-tools for versions less than 1.32.0-4
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
CVE-2025-14298
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's thegemtesearch shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...