8768 matches found
CVE-2026-21054
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data...
EUVD-2026-42824
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data...
PT-2026-57096
Name of the Vulnerable Software and Affected Versions Bixby versions prior to 4.0.70.8 Description Improper export of Android application components allows local attackers to execute arbitrary commands with Bixby privileges. Recommendations Update Bixby to version 4.0.70.8 or later...
Langflow < 1.9.2 Multiple Vulnerabilities
The version of Langflow installed on the remote host is prior to 1.9.2. It is, therefore, affected by multiple vulnerabilities: - The Shareable Playground feature enables execution of workflows by unauthenticated users. When the route /api/v1/buildpublictmp executes a flow, it allows providing...
CVE-2026-52725
A flaw was found in the @angular/core component. This vulnerability allows an attacker to bypass security restrictions when creating dynamic components. By manipulating the host element or selector, an attacker can force an Angular component to be mounted directly onto a script tag. This can resu...
DRUPAL-CONTRIB-2026-075
This module enables you to use Single Directory Components in site building views, field formatters, blocks, layouts and it improves the Developer Experience DX with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is...
PT-2026-56664
Name of the Vulnerable Software and Affected Versions Drupal UI Patterns SDC in Drupal UI versions 2.0.0 through 2.0.17 Description An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting XSS...
GHSA-CWV4-H3J5-W3CF rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path
Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 Summary plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature. When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and U...
CVE-2026-55647
DataEase (open source data visualization/analysis tool) contains an XSS flaw in dashboard text components. Before version 2.10.24, stored content rendered via Vue v-html without server-side sanitization, enabling an authenticated user who can edit dashboard component data to inject HTML with exec...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951 Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
EUVD-2026-42063
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
CVE-2026-48951 Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
GO-2026-5874 Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet...
PYSEC-2026-1523 Langflow vulnerable to remote code execution
langflow =1.0.18 is vulnerable to Remote Code Execution RCE as any component provided the code functionality and the components run on the local machine rather than in a sandbox...
PYSEC-2026-2068 Improper line feed handling in zenml
A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...