41835 matches found
EUVD-2026-93686
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-106189
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-106189
Google Chrome on iOS prior to version 155.0.8059.39 is vulnerable to a code injection flaw in ReaderMode . A remote attacker can leverage social engineering to bypass the web origin policy by tricking a user into visiting a crafted HTML page. The Chromium security severity is rated as Medium . Ex...
Exploit for Code Injection in Phpletter Ajax_File_And_Image_Manager
Zenphoto 1.4.1.4 RCE — CVE-2011-4825 A Python 3 adaptation of...
GHSA-RM89-RHWJ-9J92 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Impact An attacker who controls or tampers with an OpenAPI description can cause Kiota to emit attacker-controlled Java or PHP source outside a generated documentation comment. The affected sanitizers remove comment terminators rather than neutralizing them, allowing a terminator to reform from...
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Impact An attacker who controls or tampers with an OpenAPI description can cause Kiota to emit attacker-controlled Java or PHP source outside a generated documentation comment. The affected sanitizers remove comment terminators rather than neutralizing them, allowing a terminator to reform from...
CVE-2026-105796 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text...
CVE-2026-105796 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text...
CVE-2026-105796
The Kiota OpenAPI-based HTTP Client code generator is vulnerable to code injection in versions 0.5.0 through 1.35.0 for both Java and PHP generators. The root cause is a flaw in the documentation-comment sanitizers that delete block-comment terminators instead of neutralizing them. This allows ov...
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Summary Langflow's built-in Python interpreter components — PythonREPLComponent Python Interpreter and the legacy PythonREPLToolComponent Python REPL Tool — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the...
GHSA-8QPJ-27X8-PWPQ Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Summary Langflow's built-in Python interpreter components — PythonREPLComponent Python Interpreter and the legacy PythonREPLToolComponent Python REPL Tool — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the...
CVE-2025-15591
A Cross-Site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server . This flaw allows a bad actor to inject malicious code into a Forums web page. The vulnerability is associated with CWE-79 (Improper Neutralization of Input During Web Page Gener...
EUVD-2025-211030
Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...
CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management
Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...
CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management
Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...
CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...
DEBIAN-CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...
UBUNTU-CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...
CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...
CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...