5979 matches found
EUVD-2026-11639
Unhead has XSS bypass in useHeadSafe via attribute name injection and case-sensitive protocol check...
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Summary useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. Details XSS via data- attribute name injection The acceptDataAttrs function safe.t...
PT-2026-25021
Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...
PT-2026-25064
Name of the Vulnerable Software and Affected Versions Undici versions prior to 7.24.0 and prior to 6.24.0 Description Undici is susceptible to inconsistent interpretation of HTTP requests, specifically HTTP Request/Response Smuggling. The issue arises when duplicate HTTP Content-Length headers ar...
Unhead cross-site scripting vulnerabilities
unhead is a document header and template manager developed by UnJS. Versions of unhead prior to 2.1.11 contained a cross-site scripting vulnerability. This vulnerability stemmed from the link.href check being case-sensitive, which could allow attackers to inject arbitrary CSS for UI masking or da...
CVE-2026-1524 Auth misconfiguration when multiple providers enabled
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures...
Chromium: CVE-2026-3537 Object lifecycle issue in PowerVR
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
BELL-CVE-2026-3713 CVE-2026-3713 does not affect BellSoft software
Bulletin has no description...
The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey
AI agents that combine large language models with non-AI system components are rapidly emerging in real-world applications, offering unprecedented automation and flexibility. However, this unprecedented flexibility introduces complex security challenges fundamentally different from those in...
Improper Handling of Case Sensitivity
Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the preventProtocolOverride function, which fails to properly validate...
Improper Handling of Case Sensitivity
Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the preventProtocolOverride function, which fails to properly validate case-insensitive configuration...
EUVD-2026-10790
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE...
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Summary The blockUnsafeOperationsPlugin in simple-git fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the ext:: protocol by passing -c PROTOCOL.ALLOW=always, which...
GHSA-R275-FR43-PM7Q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Summary The blockUnsafeOperationsPlugin in simple-git fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the ext:: protocol by passing -c PROTOCOL.ALLOW=always, which...
GO-2026-4569 MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk...
CVE-2026-1508
creationtimestamp| type| source ---|---|--- 2026-03-10 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116203705252982618...
CVE-2026-29174
creationtimestamp| type| source ---|---|--- 2026-03-09 22:58:48+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j...
CVE-2026-30956
creationtimestamp| type| source ---|---|--- 2026-03-08 12:12:29+00:00| published-proof-of-concept| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m 2026-03-12 15:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mguo3bjdr32a...
SUSE CVE-2026-29054
Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to preve...
CVE-2026-30921
creationtimestamp| type| source ---|---|--- 2026-03-06 19:52:37+00:00| published-proof-of-concept| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8 2026-03-10 16:40:16+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-30921...