Cpanel::JSON::XS 安全漏洞

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-events, kaniko-fips, jfrog-cli, nfpm, grype-db, flux-source-controller-fips, amazon-ssm-agent-fips, chainctl-fips, commercial-chainloop-cli, dagger, flux, guac, melange, snyk-cli, chezmoi, zot, rancher-fleet, pulumi-language-dotnet, gomplate, gptscript,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-events, kaniko-fips, jfrog-cli, nfpm, grype-db, flux-source-controller-fips, amazon-ssm-agent-fips, chainctl-fips, commercial-chainloop-cli, dagger, flux, guac, melange, snyk-cli, chezmoi, zot, rancher-fleet, pulumi-language-dotnet, gomplate, gptscript,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-events, kaniko-fips, jfrog-cli, nfpm, grype-db, flux-source-controller-fips, amazon-ssm-agent-fips, chainctl-fips, commercial-chainloop-cli, dagger, flux, guac, melange, snyk-cli, chezmoi, zot, rancher-fleet, pulumi-language-dotnet, gomplate, gptscript,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, trivy-operator,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, trivy-operator,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, trivy-operator,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: opa-envoy, delve, portieris, terraform-provider-sendgrid, extism, k8ssandra-operator, crossplane-provider-aws-sns, clickhouse-operator, sqlexporter, neuvector-dbgen, argo-rollouts, nri-haproxy, dex, cluster-proportional-autoscaler, flyte, sonobuoy, kpt, nri-mysql,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: opa-envoy, delve, portieris, fq, extism, terraform-provider-sendgrid, k8ssandra-operator, hello-world-golang, crossplane-provider-aws-sns, clickhouse-operator, sqlexporter, neuvector-dbgen, argo-rollouts, nri-haproxy, dex, cluster-proportional-autoscaler, go-bindata,...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379 Stored Cross-Site Scripting in AES BOM Viewer

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379 Stored Cross-Site Scripting in AES BOM Viewer

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

CVE-2025-27379 affects the BOM Viewer in Altium AES 7.0.3. A stored XSS vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content. The issue is tied to the Description...

PT-2026-3895

Name of the Vulnerable Software and Affected Versions Altium AES version 7.0.3 Description A stored cross-site scripting XSS issue exists in the BOM Viewer component. An authenticated attacker can inject arbitrary JavaScript into the Description field of a schematic. This JavaScript is then...

CVE-2025-27379: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

XML External Entity (XXE) Injection

cyclonedx-core-java is vulnerable to XML External Entity XXE injection. The vulnerability is due to an insecurely configured XML Validator, where external entity processing was not fully disabled during XML validation, allowing attackers to supply a crafted CycloneDX XML BOM that triggers externa...

GHSA-FXMW-JCGR-W44V pgadmin4 has a Meta-Command Filter Command Execution

The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special byte sequences. The implemented filter uses the function hasmetacommands, which scans raw...