EUVD-2026-39903

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...

The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials

Exposed records from the private group included the personal information of a senior White House intelligence official and an active-duty special operations officer...

EUVD-2026-38803

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component...

CVE-2026-50708

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component...

CVE-2026-50708

CVE-2026-50708 affects Frappe Framework 17.0.0-dev, with a Stored XSS in the MultiSelectDialog component caused by improper neutralization of user-controlled input. The CVSS v4.0 base score is 4.8 (Medium), with network attack vector, low privileges required, and user interaction required. The im...

CVE-2026-50708

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component...

CVE-2026-50708 Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component...

CVE-2026-50708 Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component...

PT-2026-51831

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs due to improper neutralization of user-controlled input within the MultiSelectDialog component. Stored XSS is a type of vulnerability where a...

dialog-lib (>=0.0.2.7, <=0.0.3.0a0) potentially affected by CVE-2026-55443 via langchain (0.2.8)

langchain PYPI version 0.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - dialog-lib =0.0.2.7, =0.0.3.0a0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

dialog-lib (>=0.0.1.11, <=0.0.1.18) potentially affected by CVE-2026-55443 via langchain (0.2.0rc1)

langchain PYPI version 0.2.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - dialog-lib =0.0.1.11, =0.0.1.18 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

SUSE CVE-2026-12044

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

CVE-2026-12044

A flaw was found in pgAdmin 4. An authenticated user with specific permissions could exploit a SQL injection vulnerability by submitting a crafted description field in various dialog templates. This could allow the user to execute arbitrary SQL commands, potentially leading to arbitrary operating...

SQL Injection

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to SQL Injection via the description field in dialog templates when rendering SQL statements. An attacker can execute arbitrary SQL commands by submitting crafted input containing special characters to break...

CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

CVE-2026-12044

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

How the Peter Thiel-Linked Dialog Club Secretly Ranks Its Members

Leaked files show the invite-only network grades members by their money and fame, shaping who’s in, who’s out, and who pays...

Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society

More than 200 of the world's elites registered for a retreat whose agenda runs from panels on cult-building and sex to prepping for World War III. An associated app offers matchmaking...

bugbug (0.0.550), ceylon (>=0.14.13, <=0.16.16) +4 more potentially affected by CVE-2026-55443 via langchain (0.2.10)

langchain PYPI version 0.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - bugbug 0.0.550 - ceylon =0.14.13, =0.0.51, =0.0.55 - ragstack-ai-langchain 1.4.0 Source cves: CVE-2026-55443 Source advisory:...