37410 matches found
CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...
CVE-2026-68583
Luci-app-adblock-fast prior to 1.2.4-4 contains a stored XSS in the blocklist name field. When an administrator views the AdBlock Fast status page, the payload executes in the administrator’s browser under the LuCI origin. Affected version is 1.2.4-3 and earlier; upgrade to 1.2.4-4 or later to re...
EUVD-2026-51993
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...
CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...
CVE-2026-68583: Improper Neutralization of Input During Web Page Generation
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...
CVE-2026-67355
creationtimestamp| type| source ---|---|--- 2026-08-01 14:09:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5yssuoga274vr 2026-08-01 22:24:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2j4mwb6f2e 2026-08-01 22:24:37+00:00| seen|...
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
EUVD-2026-51867
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-67352 luci-app-https-dns-proxy Stored XSS via resolver_url
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-67352
CVE-2026-67352 affects luci-app-https-dns-proxy. A stored XSS flaw exists in the resolver_url parameter; authenticated users can inject active HTML, which is rendered as raw HTML on the HTTPS DNS Proxy status page and can execute JavaScript in the admin’s browser origin. Documents provide CVSS me...
opencode v1.18.11
The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...
CVE-2026-15006
creationtimestamp| type| source ---|---|--- 2026-08-01 04:12:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjzicctxlhcte 2026-08-01 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mryn3ucp2a2b 2026-08-01 13:00:52+00:00| seen|...
PT-2026-67325
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-67352: Improper Neutralization of Input During Web Page Generation
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-45330
creationtimestamp| type| source ---|---|--- 2026-07-31 23:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6ngeypsnmbjir...
EUVD-2026-44802
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...
GHSA-P849-8HWH-84J9 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...
CVE-2026-58047
creationtimestamp| type| source ---|---|--- 2026-07-31 18:06:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23v3iiu47byar 2026-08-04 16:07:10+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msbfge7k4v24 2026-08-04 16:15:25+00:00| seen|...
CVE-2026-17349
creationtimestamp| type| source ---|---|--- 2026-07-31 17:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgmxn3vz2s 2026-08-01 09:38:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6clkjkg24 2026-08-01 09:38:47+00:00| seen|...